Unauthenticated SSRF in Octo-STS GitHub App Affects Security Token Services

CVE-2025-52477

What is CVE-2025-52477?

The Octo-STS GitHub App is susceptible to an unauthenticated SSRF vulnerability, due to a flaw in handling OpenID Connect token inputs. Attackers can exploit this vulnerability by providing malicious tokens that trigger internal network requests. Such requests may inadvertently expose sensitive information, including error logs, to unauthorized users. It is crucial for users of Octo-STS to upgrade to version 0.5.3 or higher, which includes essential sanitization improvements and logging redaction to safeguard against this security threat.

References