Log Injection Vulnerability in PIA Authentication Broker by Unauthenticated Attackers

CVE-2026-12616

What is CVE-2026-12616?

The PIA Authentication Broker contains a vulnerability where the /v1/upload/sbom endpoint improperly extracts the 'iss' claim from an attacker-supplied JWT without signature verification. This enables unauthenticated attackers to inject malicious log entries that mimic legitimate authentication messages. The vulnerability arises from the log format that renders newlines literally, potentially compromising the integrity of incident response efforts by creating indistinguishable fake auth-success logs. This seriously undermines the effectiveness of the audit trail that the service relies upon for secure operational logging.

References