CVE-2025-52477 json
Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow
published 2025-06-26 16 mo ago modified 2026-09-10 1 mo ago also GHSA-h3qp-hwvr-9xcq , GO-2025-3779 , EUVD-2025-19216
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
Patch / fix
- go github.com/octo-sts/app 0.5.3
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250730T213748-1.1
opensuse advisories openSUSE-SU-2025:15405-1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/octo-sts/app | <0.5.3 |
0.5.3 |
Affected products
- octo-sts app
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd
web, patch
-
github.com
/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92
web, patch
-
github.com
/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq
web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-52477
advisory
-
github.com
/octo-sts/app
package
Sources
- CVE List CVE-2025-52477
- GitHub Advisory GHSA-h3qp-hwvr-9xcq
- NVD CVE-2025-52477
- OSV GO-2025-3779
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.