Vulnerabilities

TI-2026-84130 CVE-2026-105770

Octo STS leaks trust policy details in Exchange error messages

LOW 30

Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00256 Published 2026-11-03 Fixed in 0.11.2 CWE-209

TI-2025-32604 CVE-2025-52477 · GHSA-h3qp-hwvr-9xcq

MEDIUM 44

Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00486 Published 2025-06-26 Fixed in 0.5.3 CWE-918

TI-2024-22536 CVE-2024-34079 · GHSA-75r6-6jg8-pfcq

LOW 18

octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00581 Published 2024-05-10 Fixed in 0.1.0 CWE-400