CVE-2026-19363

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. `src/handler.rs` logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. `src/models.rs` serializes the complete validated JWT claims set with `serde_json::to_string(token_claims).unwrap()` and propagates it through `context["jwtClaims"]` to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled `jwtClaims` input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-200
• CWE-532

• https://vuldb.com/cve/CVE-2026-19363
• https://vuldb.com/submit/866093
• https://vuldb.com/vuln/387217
• https://vuldb.com/vuln/387217/cti

Published

Aug 9, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19357A security flaw has been discovered in MingSoft MCMS up to 3…5.5
• CVE-2026-19358A weakness has been identified in 3CORESec Trapdoor up to 1.…6.3
• CVE-2026-19359A security vulnerability has been detected in nxp-auto-goldv…5.1
• CVE-2026-19360A vulnerability was detected in wongcyrus ExcelLexBot up to …5.1
• CVE-2026-19361A flaw has been found in macrozheng mall 0504e86. This vulne…3.7
• CVE-2026-19362A vulnerability has been found in lmammino oidc-authorizer 0…5.5
• CVE-2026-19364A vulnerability was determined in itsourcecode Hospital Mana…6.3
• CVE-2026-19365A vulnerability was identified in Ichigo3766 image-gen-mcp 0…5.3
• CVE-2026-19366A flaw has been found in NocteDefensor LudusMCP up to 1.0.24…5.3
• CVE-2026-19367A vulnerability has been found in NocteDefensor LudusMCP 1.0…6.3
• CVE-2026-19368A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Aff…4.8
• CVE-2026-19369A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0…5.3