GHSA-h3qp-hwvr-9xcq

Suggest an improvement
Source
https://github.com/advisories/GHSA-h3qp-hwvr-9xcq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h3qp-hwvr-9xcq/GHSA-h3qp-hwvr-9xcq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h3qp-hwvr-9xcq
Aliases
Related
Published
2025-06-26T18:53:54Z
Modified
2025-06-26T19:14:53.475097Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens
Details

Summary

Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information.

Please upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.

Many thanks to @vicevirus for reporting this issue and for assisting with remediation review.

References

  • https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq
  • https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92
  • https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd
Database specific 
{
    "github_reviewed_at": "2025-06-26T18:53:54Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "nvd_published_at": "2025-06-26T17:15:30Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

Go / github.com/octo-sts/app

Package

Name
github.com/octo-sts/app
View open source insights on deps.dev
Purl
pkg:golang/github.com/octo-sts/app

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.5.3

Database specific 

{
    "last_known_affected_version_range": "<= 0.5.2"
}