CVE-2026-19363

Deferred Deferred - Pending Action

Deserialization Flaw in oidc-authorizer via JWT Claims

Publication date: 2026-08-09

Last updated on: 2026-08-12

Assigner: VulDB

Description

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. `src/handler.rs` logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. `src/models.rs` serializes the complete validated JWT claims set with `serde_json::to_string(token_claims).unwrap()` and propagates it through `context["jwtClaims"]` to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled `jwtClaims` input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-09

Last Modified

2026-08-12

Generated

2026-08-30

AI Q&A

2026-08-09

EPSS Evaluated

2026-08-28

NVD

CVE-2026-19363

EUVD

EUVD-2026-54934

Affected Vendors & Products

Vendor	Product	Version / Range
lmammino	oidc-authorizer	to 0.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the lmammino oidc-authorizer software up to version 0.4.0. It involves a flaw in the unwrap function of the src/handler.rs file where the jwtClaims argument can be manipulated to trigger deserialization. This allows remote attackers to execute arbitrary code or cause denial of service.

Detection Guidance

This vulnerability involves deserialization issues in the lmammino oidc-authorizer component. Detection may require inspecting network traffic for unusual JWT claims handling or examining logs for deserialization errors in the oidc-authorizer service.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to execute unauthorized actions, steal sensitive data, or disrupt services. Systems using vulnerable versions of oidc-authorizer may be compromised without user interaction.

Compliance Impact

This vulnerability involves improper deserialization of JWT claims, which could allow remote attackers to manipulate data. For compliance with GDPR or HIPAA, such vulnerabilities may risk unauthorized access to sensitive data, potentially violating confidentiality requirements. However, specific compliance impacts depend on system configuration and data handling practices.

Mitigation Strategies

Update the lmammino oidc-authorizer to a version beyond 0.4.0 to address the deserialization flaw in the JWT claims handling. If an update is not available, consider disabling or removing the component until a patch is released.

Hi! I’m here to help you understand CVE-2026-19363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70