Skip to content
OpenAdvisories

Vendor

octo-sts

3 known vulnerabilities.

Products

app 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-105770

    Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

    Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names …

    octo-sts app