CVE-2026-19363
Received Received - Intake

Deserialization Flaw in oidc-authorizer via JWT Claims

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is the function unwrap of the file src/handler.rs of the component Fixed Message Handler. The manipulation of the argument jwtClaims results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19363
EUVD
EUVD-2026-54934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lmammino oidc-authorizer to 0.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the lmammino oidc-authorizer software up to version 0.4.0. It involves a flaw in the unwrap function of the src/handler.rs file where the jwtClaims argument can be manipulated to trigger deserialization. This allows remote attackers to execute arbitrary code or cause denial of service.

Detection Guidance

This vulnerability involves deserialization issues in the lmammino oidc-authorizer component. Detection may require inspecting network traffic for unusual JWT claims handling or examining logs for deserialization errors in the oidc-authorizer service.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to execute unauthorized actions, steal sensitive data, or disrupt services. Systems using vulnerable versions of oidc-authorizer may be compromised without user interaction.

Compliance Impact

This vulnerability involves improper deserialization of JWT claims, which could allow remote attackers to manipulate data. For compliance with GDPR or HIPAA, such vulnerabilities may risk unauthorized access to sensitive data, potentially violating confidentiality requirements. However, specific compliance impacts depend on system configuration and data handling practices.

Mitigation Strategies

Update the lmammino oidc-authorizer to a version beyond 0.4.0 to address the deserialization flaw in the JWT claims handling. If an update is not available, consider disabling or removing the component until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19363. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart