Threats affecting pkg:cargo/lmammino/oidc-authorizer

CVE-2026-19363 is a medium severity vulnerability in lmammino oidc-authorizer up to version 0.4.0. It involves sensitive information exposure through log files due to logging raw Authorization header values and bearer tokens/JWTs on authentication failure. This can lead to credentials being exposed in CloudWatch Logs. The vulnerability affects the Lambda Authorizer component, specifically in the src/handler.rs and src/models.rs files. The vulnerability can be exploited remotely. A patch is available, and the product is a cloud service, so the vendor typically manages remediation. No known exploits are reported in the wild.

CVE-2026-19362 is a denial of service vulnerability in lmammino oidc-authorizer version 0.4.0. It affects the parse_token_from_header function responsible for parsing the Authorization header. The vulnerability allows remote attackers to cause a denial of service by manipulating the authorization_token argument. The vendor has not responded to the disclosure, and no patch or official fix is currently available. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity.