Oxia, a metadata store and coordination system, prior to version 0.16.2, logs the full bearer token in plaintext at DEBUG level when OIDC authentication fails. This behavior can lead to sensitive JWT tokens being exposed in logs and any log aggregation systems that collect these logs. The vulnerability is identified as CWE-532 (Insertion of Sensitive Information into Log File). It has a CVSS 4.0 score of 8.7 (high severity), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality. The issue is resolved in oxia version 0.16.2.

If debug logging is enabled in production on affected oxia versions (<0.16.2), sensitive bearer tokens (JWTs) are exposed in plaintext within application logs and any connected log aggregation infrastructure. This exposure could allow unauthorized parties with access to logs to obtain valid authentication tokens, potentially compromising system security. There are no known exploits in the wild at this time.

Upgrade oxia to version 0.16.2 or later, where this vulnerability is fixed. Until upgrading, avoid enabling DEBUG level logging in production environments to prevent sensitive token exposure in logs. Patch status is not explicitly stated but the vendor has fixed the issue in version 0.16.2, so applying this official fix is recommended.