JWT Verification Vulnerability in PIA by Eclipse

CVE-2026-18353

What is CVE-2026-18353?

The PIA application has a vulnerability in its /v1/upload/sbom endpoint, where it incorrectly processes unverified Bearer JWTs. The vulnerability lies in the way Python's urlparse function handles authority strings, allowing an attacker to craft a malicious issuer that circumvents the issuer allowlist check. As a result, the application may inadvertently connect to an arbitrary server chosen by the attacker for the retrieval of JWKS, potentially exposing sensitive data and compromising the security of the system.

References