SSRF in Eclipse Foundation Csi - Pia

CVE-2026-18353

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/…

Vulnerability class: SSRF (Server-Side Request Forgery)