The vulnerability in lmammino oidc-authorizer (<=0.4.0) arises from logging sensitive data such as raw Authorization headers and bearer tokens/JWTs on authentication failure paths in src/handler.rs. Additionally, the complete validated JWT claims set is serialized and propagated downstream, which may expose sensitive information. The vulnerability allows remote attackers to potentially access sensitive credentials through CloudWatch Logs. The vendor was contacted but did not respond. The product is cloud-hosted, and a patch is available. The CVSS 4.0 score is 6.9 (medium severity), with network attack vector, low complexity, no privileges or user interaction required, and partial confidentiality impact.

Sensitive information including raw Authorization headers and bearer tokens/JWTs can be exposed in log files (CloudWatch Logs), potentially allowing unauthorized parties to access credentials. This exposure could lead to compromise of authentication tokens. The vulnerability is remotely exploitable without authentication or user interaction. No known active exploitation is reported.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory or service status that the patch has been applied. Until then, sensitive logging should be reviewed and minimized if possible to reduce exposure.