CVE-2026-107597 jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

PIA's token verification verifytoken in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwksuri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the...

CVE-2026-107597

The PIA software is vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of the jwks_uri in OIDC discovery documents. Specifically, the verify_token function in pia/oidc.py follows the jwks_uri without verifying its origin, scheme, or requiring HTTPS, only checking that the...

PT-2026-118321

PIA's token verification verify token in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that th...