CVE-2026-40945 - Oxia: Bearer token exposed in debug log messages on authentication failure

Back Back to CVE browser

HIGH

Oxia: Bearer token exposed in debug log messages on authentication failure

Published Apr 21, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.54%

Description

Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.

Affected products

Vendor Oxia-DB Product Oxia Default
n/a
- Version
  < 0.16.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oxia-DB

Oxia

n/a

Version	Status	Constraints
< 0.16.2	affected	-

Ecosystem	Package	Introduced	Fixed
Go	github.com/oxia-db/oxia	0	0.16.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-532

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24511		Advisory
https://github.com/advisories/GHSA-pm7q-rjjx-979p		Advisory
https://github.com/oxia-db/oxia/commit/f7259d0ebc739fc95ff19f93c823433850857416
https://github.com/oxia-db/oxia/security/advisories/GHSA-pm7q-rjjx-979p		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-40945