Oxia vulnerabilities

Oxia prior to 0.16.2 logs the full bearer token in plaintext at DEBUG level when OIDC authentication fails. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system.

Oxia prior to 0.16.2 has a race condition between session heartbeat processing and session closure that can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to deadlock or panic.

In Oxia before 0.16.2, the OIDC authentication provider sets SkipClientIDCheck to true, disabling the aud claim validation. This allows tokens issued for other services by the same OIDC issuer to be accepted.