CVE-2026-40945
HighSummary
Oxia prior to 0.16.2 logs the full bearer token in plaintext at DEBUG level when OIDC authentication fails. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system.
Risk Assessment
The risk includes exposure of JWT tokens, which could lead to unauthorized access to the system and breach of data confidentiality.
Recommendation
Upgrade Oxia to version 0.16.2, which contains the fix. Also disable debug logging in production and regularly review logs for leaks.
Other vulnerabilities in Oxia
See all- CVE-2026-40943High
Oxia prior to 0.16.2 has a race condition between session heartbeat processing and session closure that can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to deadlock or panic.
- CVE-2026-40946Critical
In Oxia before 0.16.2, the OIDC authentication provider sets SkipClientIDCheck to true, disabling the aud claim validation. This allows tokens issued for other services by the same OIDC issuer to be accepted.
Original NVD description (English source)
Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.