EUVD-2026-54933
GHSA-gv74-4w48-83fh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication, no scope change; impact strictly limited to availability (DoS only), consistent with CWE-404 and CVSS 4.0 VA:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parse_token_from_header of the file src/parse_token_from_header.rs of the component Authorization Header Parsing. The manipulation of the argument authorization_token leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Denial of service in lmammino oidc-authorizer 0.4.0 can be triggered remotely by submitting a crafted value for the authorization_token argument processed by the parse_token_from_header function in the Authorization Header Parsing component. Any service using this Rust library to validate OIDC tokens via the HTTP Authorization header is exposed to availability disruption without requiring authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or special privileges are required - the CVSS 4.0 vector (PR:N/AC:L/AT:N/UI:N) confirms unauthenticated remote exploitation with no attack prerequisites against any service that passes network-reachable Authorization header input to the oidc-authorizer parse_token_from_header function. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) confirms unauthenticated remote exploitation with low complexity, no special attack prerequisites, and impact limited solely to the vulnerable system's availability at a low severity level - confidentiality and integrity are fully unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends an HTTP request containing a specially crafted Authorization header value to any endpoint protected by oidc-authorizer, triggering the CWE-404 improper resource release condition in parse_token_from_header. A public proof-of-concept has been disclosed, making this scenario trivially reproducible by any motivated attacker. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, leaving no confirmed fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Oidc Authorizer
View allSame weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today