{"id":"CVE-2026-116870","published":"2026-10-27T11:17:28.610","lastModified":"2026-10-27T15:08:50.630","description":"In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-1289"],"vendors":[],"products":[],"references":[{"url":"https://advisories.octopus.com/post/2026/sa2026-15","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}