CVE-2026-107597

The PIA software is vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of the jwks_uri in OIDC discovery documents. Specifically, the verify_token function in pia/oidc.py follows the jwks_uri without verifying its origin, scheme, or requiring HTTPS, only checking that the...