CVE-2026-40945: CWE-532: Insertion of Sensitive Information into Log File in oxia-db oxia
CVE-2026-40945 is a vulnerability in oxia-db's oxia metadata store and coordination system where, prior to version 0. 16. 2, failed OIDC authentication attempts cause the full bearer token to be logged in plaintext at DEBUG level. This exposes sensitive JWT tokens in application logs and any connected log aggregation systems if debug logging is enabled in production environments. The vulnerability has a high severity with a CVSS score of 8. 7. It is fixed starting from version 0. 16. 2.
AI Analysis
Technical Summary
Oxia versions before 0.16.2 log the entire bearer token in plaintext at DEBUG level when OIDC authentication fails. This logging behavior can expose sensitive JWT tokens in application logs and any external log aggregation systems that collect these logs. The vulnerability is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The issue is resolved in version 0.16.2 of oxia.
Potential Impact
If debug logging is enabled in production, sensitive JWT bearer tokens are exposed in plaintext within application logs and any connected log aggregation systems. This exposure can lead to unauthorized access if attackers obtain these tokens. The vulnerability has a high severity rating (CVSS 8.7) due to the potential confidentiality impact of leaked authentication tokens.
Mitigation Recommendations
Upgrade oxia to version 0.16.2 or later, where this vulnerability is fixed. Until the upgrade, avoid enabling DEBUG level logging in production environments to prevent sensitive token exposure. Patch status is not explicitly stated but the fix is included in version 0.16.2, so applying this official fix is the recommended remediation.
CVE-2026-40945: CWE-532: Insertion of Sensitive Information into Log File in oxia-db oxia
Description
CVE-2026-40945 is a vulnerability in oxia-db's oxia metadata store and coordination system where, prior to version 0. 16. 2, failed OIDC authentication attempts cause the full bearer token to be logged in plaintext at DEBUG level. This exposes sensitive JWT tokens in application logs and any connected log aggregation systems if debug logging is enabled in production environments. The vulnerability has a high severity with a CVSS score of 8. 7. It is fixed starting from version 0. 16. 2.
CVSS v4.0
Score 8.7high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Oxia versions before 0.16.2 log the entire bearer token in plaintext at DEBUG level when OIDC authentication fails. This logging behavior can expose sensitive JWT tokens in application logs and any external log aggregation systems that collect these logs. The vulnerability is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The issue is resolved in version 0.16.2 of oxia.
Potential Impact
If debug logging is enabled in production, sensitive JWT bearer tokens are exposed in plaintext within application logs and any connected log aggregation systems. This exposure can lead to unauthorized access if attackers obtain these tokens. The vulnerability has a high severity rating (CVSS 8.7) due to the potential confidentiality impact of leaked authentication tokens.
Mitigation Recommendations
Upgrade oxia to version 0.16.2 or later, where this vulnerability is fixed. Until the upgrade, avoid enabling DEBUG level logging in production environments to prevent sensitive token exposure. Patch status is not explicitly stated but the fix is included in version 0.16.2, so applying this official fix is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-15T20:40:15.519Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e7f01d19fe3cd2cdfcab4a
Added to database: 4/21/2026, 9:46:05 PM
Last enriched: 4/29/2026, 11:14:30 AM
Last updated: 6/5/2026, 4:13:00 AM
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.