Vulnerability · Published Aug 9, 2026 · Assigned by VulDB
CVE-2026-19363lmammino oidc-authorizer Lambda Authorizer handler.rs log file
Medium 5.3
In plain English
A medium-severity sensitive data in logs in oidc-authorizer from lmammino. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. `src/handler.rs` logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. `src/models.rs` serializes the complete validated JWT claims set with `serde_json::to_string(token_claims).unwrap()` and propagates it through `context["jwtClaims"]` to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled `jwtClaims` input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| lmammino | oidc-authorizer | 0.10.20.30.4.0 |
Weakness: CWE-532, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-387217 | lmammino oidc-authorizer Lambda Authorizer handler.rs log file vdb-entry
- VDB-387217 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-19363 | CVE Analysis and Report third-party-advisory
- Submit #866093 | lmammino oidc-authorizer 0.4.0 Exposure of Sensitive Information Through Metadata third-party-advisory