The vulnerability lies in lmammino oidc-authorizer’s handler, where raw Authorization header values and full bearer tokens or JWTs are logged on authentication failure. Because these logs are stored in CloudWatch Logs, an attacker can obtain sensitive credentials or complete token strings by inducing failures or by sending crafted requests. In addition, the component serializes and forwards the entire JWT claims set to downstream integrations without sanitizing the data, potentially exposing sensitive claim information. This presents a direct confidentiality risk through information disclosure in logs and may leak credential details to anyone monitoring CloudWatch or consuming the unsanitized claims.

Any deployment of lmammino oidc-authorizer version 0.4.0 or earlier is affected. The vendor product is the oidc-authorizer component, and the issue exists in all build releases prior to 0.4.0. The CVE data does not indicate that newer releases fix the issue, and the vendor has not responded to disclosure. Systems running older bundles should consult the vendor’s release notes for any updates.

The CVSS score of 6.9 indicates a medium‑to‑high severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The description indicates that the issue can be triggered remotely by sending requests that result in authentication failures or by providing malformed Authorization headers. The attacker can thus obtain sensitive tokens or JWT claim data via CloudWatch Logs, or potentially through downstream integrations that receive unsanitised JWT claims. The risk is significant for any environment that has not applied a patch or mitigations that remove or mask this sensitive information.