CVE-2026-40945

Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.

• CWE-532

• https://github.com/oxia-db/oxia/security/advisories/GHSA-pm7q-rjjx-979p

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40939The Data Sharing Framework (DSF) implements a distributed pr…6.8
• CVE-2026-4094The FOX – Currency Switcher Professional for WooCommerce plu…8.1
• CVE-2026-40941Cacti is an open source performance and fault management fra…6.5
• CVE-2026-40942The Data Sharing Framework (DSF) implements a distributed pr…6.3
• CVE-2026-40943Oxia is a metadata store and coordination system. Prior to 0…8.7
• CVE-2026-40944Oxia is a metadata store and coordination system. Prior to 0…6.9
• CVE-2026-40946Oxia is a metadata store and coordination system. Prior to 0…9.2
• CVE-2026-40947Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, an…2.9
• CVE-2026-40948The Keycloak authentication manager in `apache-airflow-provi…5.4
• CVE-2026-40949CVE-2026-40949 is a buffer overflow vulnerability in the Sec…4.4
• CVE-2026-40950CVE-2026-40950 is a buffer overflow vulnerability in the Sec…6.5
• CVE-2026-40951CVE-2026-40951 is a memory corruption vulnerability on Secur…5.5