The vulnerability allows PIA’s token verification routine to download an OIDC discovery document from any issuer and then blindly fetch the jwks_uri field without validating its origin, scheme or HTTPS requirement. Because the fetch occurs before any token signature is verified, an attacker could supply a malicious JWKS that appears authentic to PIA and causes mis‑verification of identity tokens, effectively allowing forged authentication and privilege escalation. The flaw is confined to the OIDC discovery step and does not directly enable arbitrary code execution, but it can be leveraged to impersonate a trusted identity provider and gain unauthorized access to protected resources.

The affected product is Eclipse CSI – PIA from the Eclipse Foundation. Specific version or patch level information is not enumerated in the advisory, so any installation that has not applied the latest update from the project may be vulnerable. Dedicated per‑project Jenkins instances that rely on PIA for OIDC also fall under the same risk window.

The CVSS score of 5.1 rates this as a medium‑severity issue. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widely observed exploitation to date. The likely attack vector requires the attacker to control or spoof an approved identity provider that PIA will query; once this is achieved, a single unauthenticated POST to the /v1/upload/sbom endpoint triggers the insecure fetch. Because the flaw allows the server to contact arbitrary hosts from inside the network, it can be used to exfiltrate data or reach internal services, and the subsequent injection of a malicious JWKS can result in unauthorized token acceptance. The combination of moderate CVSS score and lack of known public exploits suggests a reasonable but not imminent risk, though the potential for abuse warrants immediate mitigation.