CVE-2026-19363
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. src/models.rs serializes the complete validated JWT claims set with serde_json::to_string(token_claims).unwrap() and propagates it through context["jwtClaims"] to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled jwtClaims input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
Exposure of JWT tokens and credentials in logs could allow an attacker to hijack sessions or escalate privileges in a cloud environment.
Recommendation
Upgrade oidc-authorizer to a version newer than 0.4.0 if available, and avoid logging sensitive data such as Authorization headers.
Original NVD description (English source)
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. `src/handler.rs` logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. `src/models.rs` serializes the complete validated JWT claims set with `serde_json::to_string(token_claims).unwrap()` and propagates it through `context["jwtClaims"]` to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled `jwtClaims` input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.