Description (CNA)
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. `src/handler.rs` logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. `src/models.rs` serializes the complete validated JWT claims set with `serde_json::to_string(token_claims).unwrap()` and propagates it through `context["jwtClaims"]` to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled `jwtClaims` input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| lmammino / oidc-authorizer | affected 0.1; affected 0.2; affected 0.3; affected 0.4.0 |
CWE
CWE-532, CWE-200
References
- https://vuldb.com/vuln/387217
- https://vuldb.com/vuln/387217/cti
- https://vuldb.com/cve/CVE-2026-19363
- https://vuldb.com/submit/866093
ADP enrichment
No English description supplied.
No references supplied.