CVE-2026-12616

Popis

The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation gate. Because the configured log format (-%(asctime)s - %(name)s - %(levelname)s - %(message)s-) renders newlines literally, an unauthenticated attacker can forge log records that are byte-for-byte indistinguishable from PIA-s genuine -Successfully authenticated project- message. PIA is an authentication broker whose logs are explicitly relied upon for incident response (DESIGN.md §5.4 lists -Token verifications- and -Errors- as events to log), so the ability to plant fake auth-success entries directly undermines the audit trail the service exists to produce.