CVE-2026-116870

The record

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.

Affected packages

Related vulnerabilities

• CVE-2026-116197 Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry… CWE-1289
• CVE-2026-114348 webpack-dev-server is a development server that provides live reloading for webpack… CWE-1289
• CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
• CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
• CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289
• CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia… CWE-1289
• CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode… CWE-1289
• CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal… CWE-1289