PT-2026-34189 · Oxia · Oxia

Published 2026-04-14 · Updated 2026-04-26 · CVE-2026-40945

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Oxia versions prior to 0.16.2

Description When OIDC (OpenID Connect, an identity layer on top of the OAuth 2.0 protocol) authentication fails, the full bearer token is logged in plaintext at the DEBUG level. If debug logging is enabled in production, JWT (JSON Web Tokens) are exposed in application logs and any connected log aggregation system.

Recommendations Update to version 0.16.2.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-40945

GHSA-PM7Q-RJJX-979P

Affected Products

Oxia

References · 6

• https://osv.dev/vulnerability/GHSA-pm7q-rjjx-979p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40945 · Security Note
• https://github.com/oxia-db/oxia/commit/f7259d0ebc739fc95ff19f93c823433850857416 · Note
• https://github.com/oxia-db/oxia · Note
• https://github.com/oxia-db/oxia/security/advisories/GHSA-pm7q-rjjx-979p · Note
• https://twitter.com/CVEnew/status/2048481093704167734 · Twitter Post