Skip to content
OpenAdvisories

Package · Go

github.com/octo-sts/app

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2025-52477

    Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

    Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal netwo…

    octo-sts app github.com/octo-sts/app Go