Weakness in Token Verification Process of Eclipse PIA

CVE-2026-107597

What is CVE-2026-107597?

Eclipse PIA contains a vulnerability in its token verification process that allows an approved identity provider to direct PIA to make requests to any arbitrary host and port. This occurs because the OIDC discovery document is fetched without properly validating the 'jwks_uri' or ensuring secure HTTPS connections. As a result, potential attackers can exploit this flaw by manipulating token verification to send requests from PIA's internal network, leading to unauthorized access to sensitive information.

References