CVE-2026-19363

Name of the Vulnerable Software and Affected Versions lmammino oidc-authorizer versions prior to 0.4.1

Description The Lambda Authorizer component contains an issue where raw Authorization header values and complete bearer tokens or JWTs are logged on authentication failure paths, potentially exposing credentials through CloudWatch Logs. Additionally, the unwrap() function in the src/handler.rs file is impacted. The system serializes the complete validated JWT claims set using serde json::to string(token claims).unwrap() and propagates it through the jwtClaims variable to downstream integrations. This issue can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.