Oxia versions prior to 0.16.2 log the full bearer token used for OpenID Connect authentication when the authentication fails. Because this information is written to the application debug log in plaintext, any system that collects logs—including remote log aggregation services—may inadvertently expose JWT tokens. If an attacker obtains a valid bearer token from these logs, they could impersonate the user and access protected resources without authorization, leading to potential compromise of data confidentiality and integrity. The weakness is identified as CWE-532, a flaw in data privacy and log handling.

The vulnerability affects the Oxia metadata store and coordination system, specifically the oxia-db:oxia product. Versions up to and including 0.16.1 are susceptible; the fix is included in 0.16.2 and later releases.

The CVSS score of 8.7 classifies this exposure as a high severity issue. While the EPSS score is not supplied, the lack of a public exploit in KEV suggests low to moderate exploitation probability at present, yet the critical nature of token leakage warrants immediate attention. If debug logging is enabled in a production environment, the attack vector is likely through an OIDC authentication attempt that fails, causing the token to be inadvertently recorded. Thus, the primary risk is token disclosure that could enable unauthorized actions.