CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2026-40945
High (8.7). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/oxia-db/oxia 0.16.2.
Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
- CWE
- CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pm7q-rjjx-979p | Go | github.com/oxia-db/oxia | <0.16.2 | 0.16.2 |
| GO-2026-5546 | Go | github.com/oxia-db/oxia | <0.16.2 | 0.16.2 |