CVE-2025-52477CWE-918

Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

High · published June 26, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-06-26T16:46Z
EPSS history
Timeline
  • 26 JUN 16:46Z
    Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow
    cvelistv5