Skip to content
OpenAdvisories

Package · Go

github.com/octo-sts/app

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.6
    CVE-2025-52477

    Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

    Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal netwo…

    octo-sts app github.com/octo-sts/app Go
  • Low 3.7
    CVE-2024-34079

    octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage

    octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. …

    octo-sts app github.com/octo-sts/app Go