EUVD-2026-54934
GHSA-fwrx-97hw-xg2r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with no auth required; impact limited to partial confidentiality per available data, no integrity or availability effect confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is the function unwrap of the file src/handler.rs of the component Fixed Message Handler. The manipulation of the argument jwtClaims results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unsafe deserialization in lmammino/oidc-authorizer (versions up to 0.4.0) exposes confidential data via manipulated JWT claims submitted to the Fixed Message Handler component. The vulnerable code path runs through the unwrap function in src/handler.rs, which processes the jwtClaims argument without adequate deserialization controls - particularly concerning given this component's role as an OIDC authorization gatekeeper. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with low complexity; a public proof-of-concept exists (E:P), and the vendor has not responded to disclosure, meaning no patch has been confirmed.
Technical ContextAI
oidc-authorizer (CPE: cpe:2.3:a:lmammino:oidc-authorizer:*:*:*:*:*:*:*:*) is a Rust-based OpenID Connect JWT authorization handler - most likely deployed as an AWS Lambda authorizer or similar serverless gateway gatekeeper. The root cause is CWE-502 (Deserialization of Untrusted Data): the unwrap() call in src/handler.rs processes attacker-controlled jwtClaims input through a deserialization path without sanitization or type-safe validation guards. While Rust is memory-safe by default, deserialization libraries such as serde can panic on malformed input or expose internal state when operating on untrusted data structures. The 'Fixed Message Handler' component label suggests this is a structured message parsing path, making the deserialization surface predictable and potentially easy to probe.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer did not respond to disclosure. Operators should immediately audit deployments for oidc-authorizer versions at or below 0.4.0. As a primary compensating control, restrict network access to the oidc-authorizer endpoint to trusted internal networks or API gateway layers only, preventing unauthenticated external access to the JWT claims processing path; this addresses the AV:N attack vector but does not eliminate the underlying flaw. Secondarily, consider disabling or replacing the Fixed Message Handler component if it is not operationally required. Monitor VulDB (https://vuldb.com/vuln/387217) and the upstream repository (lmammino/oidc-authorizer on GitHub) for any out-of-band patch releases. If a patched version is released above 0.4.0, upgrade immediately. Organizations with high sensitivity to authentication pipeline integrity should treat this as a blocking issue and evaluate alternative OIDC authorizer implementations until a fix is confirmed.
More in Oidc Authorizer
View allSame weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today