CVE-2025-52477 Details
Description
Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
A vulnerability allowing unauthenticated Server-Side Request Forgery (SSRF) has been identified in Octo-STS, a GitHub App that functions as a Security Token Service for the GitHub API. This issue affects Octo-STS versions prior to 0.5.3. The vulnerability arises from the improper handling of OpenID Connect token fields, which can be exploited by malicious tokens to trigger internal network requests. These requests may inadvertently expose sensitive information by reflecting error logs that contain private data.
Users are advised to upgrade to Octo-STS version 0.5.3 or later, which addresses this vulnerability by implementing input validation for critical OpenID Connect token fields and sanitizing error logs to remove sensitive information.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2025CISA-ADP
Assessed Jun 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd | [email protected] | Source CodeVendor |
| https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92 | [email protected] | Source CodeVendor |
| https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Octo-STS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2025 | New CVE Received | [email protected] |