CVE-2025-52477: Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

The vulnerability is an unauthenticated SSRF in Octo-STS, which can be exploited by sending a malicious OpenID Connect token. The patches address this by adding input validation and redacting sensitive information from logs. The analysis of the commits reveals that the Exchange function in pkg/octosts/octosts.go, the CheckToken function in pkg/octosts/trust_policy.go, and the Get function in pkg/provider/provider.go were all processing the OIDC token without proper validation, making them vulnerable to SSRF. The new functions in pkg/oidcvalidate/validate.go are the mitigation, not the vulnerability. The Exchange function is the main entry point for processing the token and is therefore the primary vulnerable function. The CheckToken function also processes the token and is vulnerable. The Get function was vulnerable to SSRF during OIDC discovery.