https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:38:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292606 EUVD-2026-292606 https://cve.radiocsirt.org/vuln/euvd-2026-292606 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40945 <p>Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.</p> <p>Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40945 https://cve.radiocsirt.org/vuln/ghsa-pm7q-rjjx-979p <p><strong>Affected:</strong> Go: github.com/oxia-db/oxia</p> <p>### Summary When OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system.</p> <p>### Impact An attacker with access to application logs (e.g., via a compromised log aggregation pipeline, shared logging infrastructure, or misconfigured log access controls) can extract valid JWT tokens and replay them to authenticate as legitimate users.</p> <p>All versions using OIDC authentication are affected.</p> <p>### Details In `oxiad/common/rpc/auth/interceptor.go`, the `validateTokenWithContext()` function logs the complete token value via `slog.String(&#34;token&#34;, token)` when authentication fails. This includes the full JWT header, payload, and signature.</p> <p>### Patches Fixed by redacting the token in log output — only the last 8 characters are preserved for correlation purposes.</p> <p>### Workarounds Ensure DEBUG-level logging is never enabled in production environments.</p> <p><strong>Affected:</strong> Go: github.com/oxia-db/oxia</p> <p>### Summary When OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system.</p> <p>### Impact An attacker with access to application logs (e.g., via a compromised log aggregation pipeline, shared logging infrastructure, or misconfigured log access controls) can extract valid JWT tokens and replay them to authenticate as legitimate users.</p> <p>All versions using OIDC authentication are affected.</p> <p>### Details In `oxiad/common/rpc/auth/interceptor.go`, the `validateTokenWithContext()` function logs the complete token value via `slog.String(&#34;token&#34;, token)` when authentication fails. This includes the full JWT header, payload, and signature.</p> <p>### Patches Fixed by redacting the token in log output — only the last 8 characters are preserved for correlation purposes.</p> <p>### Workarounds Ensure DEBUG-level logging is never enabled in production environments.</p> https://cve.radiocsirt.org/vuln/ghsa-pm7q-rjjx-979p