SSRF in Octo-Sts App
CVE-2025-52477
Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.004 (33.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Octo-sts App — versions < 0.5.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-52477?
- CVE-2025-52477 is a high-severity vulnerability in Octo-Sts App, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2025-06-26.
- How severe is CVE-2025-52477?
- High severity. CVSS v3 base score is 8.6 out of 10.