Medium severity · published Oct 20, 2026
CVE-2026-108062
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
6.9
CVSS
0.5%
EPSS
No
On KEV
Description
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Eclipse CSI - PIA · Eclipse Foundation
through 0.8.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108062
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108062
github.com
https://github.com/eclipse-csi/pia/security/advisories/GHSA-jj77-2gc8-7pc6
gitlab.eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/400
More from Eclipse CSI - PIA
8.8
CVE-2026-18353
Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
8.2
CVE-2026-14336
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of…
6.9
CVE-2026-12616
The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements…
5.1
CVE-2026-107597
jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme