Eclipse Foundation Eclipse CSI - PIA

• CVE-2026-107597 Medium 5.1 jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme 0.4%
• CVE-2026-108062 Medium 6.9 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop 0.5%
• CVE-2026-18353 High 8.8 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass 0.3%
• CVE-2026-14336 High 8.2 PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as 0.3%
• CVE-2026-12616 Medium 6.9 The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation g 0.5%