Threat Intelligence Database

A vulnerability exists in lmammino oidc-authorizer up to version 0.4.0 in the unwrap function of src/handler.rs. The issue involves manipulation of the jwtClaims argument leading to unsafe deserialization. This vulnerability can be exploited remotely. The vendor has not responded to disclosure attempts. The CVSS score is 5.3, indicating a medium severity risk.

A denial of service vulnerability exists in lmammino oidc-authorizer version 0.4.0 affecting the Authorization Header Parsing component. The flaw is in the parse_token_from_header function, where manipulation of the authorization_token argument can cause a denial of service. Remote exploitation is possible, and the vulnerability has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or fix is currently available.

CVE-2026-19363 is a medium severity vulnerability in lmammino oidc-authorizer up to version 0.4.0. It involves sensitive information exposure through log files due to logging raw Authorization header values and bearer tokens/JWTs on authentication failure. This can lead to credentials being exposed in CloudWatch Logs. The vulnerability affects the Lambda Authorizer component, specifically in the src/handler.rs and src/models.rs files. The vulnerability can be exploited remotely. A patch is available, and the product is a cloud service, so the vendor typically manages remediation. No known exploits are reported in the wild.

CVE-2026-19362 is a denial of service vulnerability in lmammino oidc-authorizer version 0.4.0. It affects the parse_token_from_header function responsible for parsing the Authorization header. The vulnerability allows remote attackers to cause a denial of service by manipulating the authorization_token argument. The vendor has not responded to the disclosure, and no patch or official fix is currently available. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity.