Octopus Deploy's Octopus Server inconsistently validates the issuer claim of OpenID Connect tokens, allowing an attacker to supply a token issued by a non‑legitimate but properly configured issuer that is accepted as belonging to a legitimate service account. This flaw represents an improper authentication weakness (CWE-1289) that can enable unauthorized impersonation and potentially grant an attacker the permissions of the compromised service account.

All affected Octopus Server versions released by Octopus Deploy, as identified in the advisory. No specific patch version is listed, so all versions prior to the release of the fix remain vulnerable.

The CVSS score of 8.7 classifies this vulnerability as high severity. EPSS data is not available, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to have a service account with at least one OIDC identity configured and to know or guess some details of that identity, suggesting that passive information gathering or social engineering may be prerequisites. Once exploited, the attacker could impersonate the service account and gain whatever access that account provides, potentially compromising internal workflows and automation tooling.