CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow
Unauthenticated attackers can trigger SSRF via OIDC tokens to access internal networks and leak sensitive information from error logs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52477?
CVE-2025-52477 is a high-severity server-side request forgery vulnerability in octo-sts app, published on 26 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
Weakness: CWE-918
Which versions are affected by CVE-2025-52477?
3 open source packages ship an affected version, including github.com/octo-sts/app.
| Package | Affected | Fixed in |
|---|---|---|
github.com/octo-sts/app Go | All versions | 0.5.3 |
github.com/octo-sts/app Go | All versions | 0.5.3 |
github.com/octo-sts/app Go | All versions | 0.5.3 |
How do I fix CVE-2025-52477?
Upgrade github.com/octo-sts/app to 0.5.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-52477 being exploited?
There is no known exploitation of CVE-2025-52477 in the wild and no public exploit code.
Sources
Also known as GHSA-h3qp-hwvr-9xcq, GO-2025-3779.