GCVE - cpe:2.3:a:octo-sts:app:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:octo-sts:app:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Octo Sts (`960ab146-8f2f-5f71-a879-f82d0e803c2f`)
Product	App (`68074f31-3316-516a-8dda-20f54f7edb99`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-52477`	vulnerable	2026-06-08 07:31:11.664796	Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow HIGH (8.6) Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging. Published: 2025-06-26T16:46:09.380Z Updated: 2025-06-27T13:16:43.418Z Open on db.gcve.eu Reference links https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-34079`	vulnerable	2026-06-08 06:37:32.627008	octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage LOW (3.7) octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. This vulnerability is fixed in 0.1.0 Published: 2024-05-10T19:05:49.063Z Updated: 2024-08-02T02:42:59.947Z Open on db.gcve.eu Reference links https://github.com/octo-sts/app/security/advisories/GHSA-75r6-6jg8-pfcq https://github.com/octo-sts/app/commit/74ba874c017cf973edd6711144cf4399a9fcff57	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.