In JwtValidator.resolvePublicKey, the Validator checks the jku and sends an HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address. This can cause an SSRF vulnerability.

See https://access.redhat.com/security/cve/CVE-2024-1233.