CVE-2026-40945CWE-532

Oxia: Bearer token exposed in debug log messages on authentication failure

High · published April 21, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-04-21T21:16Z
EPSS history
Timeline
  • 21 APR 21:16Z
    Oxia: Bearer token exposed in debug log messages on authentication failure
    cvelistv5