The /v1/upload/sbom endpoint of PIA reads the iss claim from a JWT that has been issued by an attacker, verifies its signature in a disabled mode, and inserts the raw claim into three log messages before any validation occurs. The log formatter renders literal newline characters, allowing an attacker to inject newlines and produce log entries that are indistinguishable from legitimate "Successfully authenticated project" messages. This flaw allows an unauthenticated user to fabricate successful authentication records, undermining the integrity of the audit trail that PIA is intended to provide.

Eclipse Foundation’s PIA (Authentication Broker) is affected. Specific impacted versions are not listed in the available data, so any installation running the current release that includes the /v1/upload/sbom endpoint may be vulnerable.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is not available, and the flaw is not currently listed in the CISA KEV catalog. The vulnerability can be exploited by an unauthenticated attacker who can craft a JWT with a malicious iss claim and send it to the upload endpoint, thereby forging audit log entries. Such forgery could allow attackers to hide malicious activity or falsely indicate authorization events.