Oxia OIDC Authentication Logging Vulnerability Exposing Bearer Tokens

A vulnerability in Oxia, a metadata store and coordination system, allows for the exposure of OpenID Connect (OIDC) bearer tokens in application logs. This issue occurs in versions prior to 0.16.2. When OIDC authentication fails, the full bearer token is logged in plaintext at the DEBUG level. If debug logging is enabled in production, this exposes JSON Web Tokens (JWT) in application logs and any connected log aggregation systems. All versions using OIDC authentication are affected.

Impact

This vulnerability could lead to unauthorized authentication, as an attacker with access to the exposed JWT tokens could replay them to authenticate as legitimate users.

Remediation

The vulnerability has been fixed in Oxia version 0.16.2. Users should also ensure that DEBUG-level logging is not enabled in production environments.