CVE-2026-108062

MediumCVSS 6.9/10Last modified Oct 20, 2026

Description

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Eclipse FoundationEclipse CSI - PIA<= 0.8.0

References

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1080635.5A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongsiCVE-2026-1080646.5The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL cCVE-2026-1080659.8SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — misCVE-2026-1080662.7The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authenticatiCVE-2026-1080695.3The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before aCVE-2026-108076.3A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiCVE-2026-1080708.7A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to aCVE-2026-1080718.7Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticaCVE-2026-1080725.4Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared thCVE-2026-1080735.3The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single uCVE-2026-108086.3A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown function of the file /manage_student.php.CVE-2026-1080828.7Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19,