CVE-2025-52477: Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens
Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information.
Please upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
Many thanks to @vicevirus for reporting this issue and for assisting with remediation review.
References
- github.com/advisories/GHSA-h3qp-hwvr-9xcq
- github.com/octo-sts/app
- github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd
- github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92
- github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq
- nvd.nist.gov/vuln/detail/CVE-2025-52477
Code Behaviors & Features
Detect and mitigate CVE-2025-52477 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →