CVE-2026-14336: PIA OIDC Issuer Allowlist Bypass via Insufficient URL Validation

Technical summary

The vulnerability exists in PIA's oidc.is_issuer_known function (pia/models.py:139), which validates OIDC issuer URLs using a string prefix check (issuer.startswith('https://ci.eclipse.org')) rather than parsing and validating the issuer as a properly constrained URL. This permits two attack vectors: (1) userinfo trick—an issuer like 'https://[email protected]' passes the prefix check but directs requests to evil.host, and (2) suffix trick—an issuer like 'https://ci.eclipse.org.evil.host' similarly bypasses validation. An unauthenticated POST request to /v1/upload/sbom can exploit this flaw to force PIA to issue OIDC discovery and JWKS fetch requests to an attacker-controlled host, retrieve a signing key from that host, and validate JWTs signed with that key. The root cause is inadequate URL parsing and host validation; the function conflates URL scheme and hostname prefix with actual host identity.

Business impact

An attacker exploiting this vulnerability can forge valid authentication tokens and interact with PIA's SBOM upload functionality without legitimate credentials. If SBOM uploads are used in supply-chain security workflows, procurement pipelines, or artifact validation, attackers could inject malicious or tampered SBOMs into downstream systems. This undermines the integrity of software component tracking and could facilitate supply-chain attacks. The vulnerability is network-accessible and requires no authentication, making it trivially exploitable by external threat actors.

Affected systems

PIA (all versions containing the vulnerable is_issuer_known function) is affected. No specific version boundaries are provided in the advisory; users should check their PIA deployment version and consult the vendor advisory for affected release ranges and patch availability.

Exploitability

Exploitability is very high. The vulnerability requires no user interaction, no authentication, and no special network position. Any unauthenticated attacker with network access to PIA can craft a malicious OIDC issuer URL and POST a request to /v1/upload/sbom. The attacker only needs to control a domain and host an OIDC discovery endpoint and JWKS endpoint that serve crafted signing keys. No exotic techniques or race conditions are required; the attack is deterministic and reliable.

Remediation

Patch PIA to a version that properly validates OIDC issuer URLs by parsing them as URIs and verifying the host component against an allowlist, rather than using string prefix matching. The fix should extract the hostname from the issuer URL and compare it directly to trusted hosts (e.g., 'ci.eclipse.org'), preventing the userinfo and suffix tricks. Verify the patched version against the vendor advisory before deployment.

Patch guidance

Contact the PIA vendor or monitor their advisory channels for a patched release. When available, prioritize patching this vulnerability immediately given its HIGH severity and unauthenticated attack vector. Apply the patch to all PIA instances, especially those exposed to untrusted networks or integrated with supply-chain tooling. Verify that the patched version includes proper URL parsing and host-based validation of OIDC issuers. Test the patch in a non-production environment to confirm OIDC token validation still functions correctly for legitimate issuers.

Detection guidance

Monitor for POST requests to /v1/upload/sbom endpoints with OIDC issuer URLs that do not match your known trusted issuers, particularly those containing '@' characters (userinfo trick) or domain suffixes that extend known trusted hosts. Log and alert on OIDC discovery requests or JWKS fetch requests to unexpected external hosts. Inspect token signing key sources—if keys are being retrieved from hosts outside your organization, investigate. In a WAF or proxy, consider temporarily restricting POST /v1/upload/sbom access to known-good client IPs or requiring additional authentication until the patch is deployed.

Why prioritize this

This vulnerability merits immediate patching because it combines high impact (token forgery, unauthenticated access), complete lack of authentication or interaction requirements, and a simple attack surface. Any attacker capable of controlling a domain can forge valid tokens. The ability to influence SBOM uploads directly threatens supply-chain integrity. The CVSS 8.2 (HIGH) score reflects the integrity impact and network accessibility.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) is driven by: Network-accessible attack vector (AV:N), low complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), unchanged scope (S:U), low confidentiality impact (C:L), and high integrity impact (I:H). The integrity impact is high because attackers can forge and inject arbitrary tokens into OIDC validation. The low confidentiality impact reflects potential information disclosure through OIDC discovery or error responses, but not direct data exfiltration. Availability is unaffected (A:N).

Frequently asked questions