CVE-2026-19363 describes a vulnerability in the lmammino oidc-authorizer project affecting versions up to 0.4.0. The flaw is located in the unwrap function within src/handler.rs, specifically in the Fixed Message Handler component. Manipulating the jwtClaims argument results in unsafe deserialization, which can be triggered remotely without authentication or user interaction. The vulnerability has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating low complexity and no privileges required, with limited confidentiality impact. The vendor was contacted but did not respond, and no patch or remediation information is available. Exploit code has been publicly disclosed, but no known exploitation in the wild has been reported.

The vulnerability allows remote attackers to manipulate the jwtClaims argument causing unsafe deserialization, which may lead to limited confidentiality loss. There is no impact on integrity or availability reported. The exploit is publicly known, increasing the risk of potential attacks. However, no active exploitation in the wild has been confirmed.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor the vendor's channels for updates. Until a fix is released, consider implementing additional input validation or restricting access to the vulnerable component if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.