{"schema_version":"1.7.3","id":"GHSA-h3qp-hwvr-9xcq","published":"2025-06-26T18:53:54Z","modified":"2026-02-04T03:32:03.476170Z","aliases":["CVE-2025-52477","GO-2025-3779"],"related":["CGA-w4gx-3ppv-4xx2"],"summary":"Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens","details":"##  Summary\n\nOcto-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. \n\nPlease upgrade to v0.5.3 to resolve this issue. This version includes patch sets to [sanitize input](https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92) and [redact logging](https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd).\n\nMany thanks to @vicevirus for reporting this issue and for assisting with remediation review.\n\n## References\n\n- https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq\n- https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92\n- https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd","affected":[{"package":{"name":"github.com/octo-sts/app","ecosystem":"Go","purl":"pkg:golang/github.com/octo-sts/app"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.5.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h3qp-hwvr-9xcq/GHSA-h3qp-hwvr-9xcq.json"}}],"references":[{"type":"WEB","url":"https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52477"},{"type":"WEB","url":"https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd"},{"type":"WEB","url":"https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92"},{"type":"PACKAGE","url":"https://github.com/octo-sts/app"}],"database_specific":{"cwe_ids":["CWE-918"],"github_reviewed":true,"github_reviewed_at":"2025-06-26T18:53:54Z","nvd_published_at":"2025-06-26T17:15:30Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}