What’s Vulnerable › Vulnerabilities

CVE-2026-108062: Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-20
• Weakness: CWE-400

Description

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

Affected products

• Eclipse Foundation Eclipse CSI - PIA: through 0.8.0

References

• https://github.com/eclipse-csi/pia/security/advisories/GHSA-jj77-2gc8-7pc6
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/400

Get alerted when CVE-2026-108062 or the next vulnerability affects your stack