Vulnerability Description
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. `src/handler.rs` logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. `src/models.rs` serializes the complete validated JWT claims set with `serde_json::to_string(token_claims).unwrap()` and propagates it through `context["jwtClaims"]` to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled `jwtClaims` input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://vuldb.com/cve/CVE-2026-19363
- https://vuldb.com/submit/866093
- https://vuldb.com/vuln/387217
- https://vuldb.com/vuln/387217/cti
FAQ
What is CVE-2026-19363?
CVE-2026-19363 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive ...
How severe is CVE-2026-19363?
CVE-2026-19363 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-19363?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.