Insufficient URL Validation in OIDC Issuer Allowlist

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix check while pointing the OIDC discovery and JWKS fetches at a server the attacker controls. An unauthenticated caller of POST /v1/upload/sbom can use this to force PIA to make outbound HTTP(S) requests to an arbitrary attacker-chosen host, and to have oidc.verify_token accept a JWT signed with the attacker's own key.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects PIA's OIDC token validation mechanism in Jenkins, where a string-prefix check fails to properly validate issuer URLs as bound to legitimate hosts. Instead of parsing the issuer as a complete URL with host boundaries, the code uses a simple startswith() comparison, allowing attackers to bypass allowlist controls using URL tricks like userinfo injection (https://ci.eclipse.org@evil.host) or subdomain suffix tricks (https://ci.eclipse.org.evil.host). This enables token validation against attacker-controlled OIDC servers, leading to unauthorized authentication and potential privilege escalation in Jenkins environments. Any organization using PIA's OIDC integration for Jenkins token validation is affected.

Casky's 331 mapped security skills detect this attack pattern through MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Claude AI with extended reasoning identifies indicators such as: malformed OIDC issuer URLs bypassing validation filters, suspicious JWKS fetch requests redirecting to unexpected hosts, token validation succeeding against non-legitimate issuers, and authentication patterns indicating credential compromise. Practitioners would observe findings revealing insufficient URL parsing logic, allowlist bypass attempts in authentication logs, and reconnaissance activity probing OIDC endpoint responses—all signals that adversaries are exploiting lenient issuer validation to forge or redirect token validation flows.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14336.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

analyzing-cloud-storage-access-patterns

cloud security · low

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-14336

Casky has 331 skills that investigate the attack patterns behind CVE-2026-14336. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn