Oxia
Monthly
Authentication bypass in Oxia (oxia-db) metadata store and coordination system prior to 0.16.2 allows an attacker holding a valid OIDC/JWT token issued for a different service by the same identity provider to authenticate to Oxia. The OIDC provider unconditionally set SkipClientIDCheck: true in the go-oidc verifier, disabling library-level audience (aud) validation and breaking the audience/tenant isolation that OAuth2/OIDC relies on. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records no known exploitation, but the technical impact is rated total.
Sensitive information disclosure in Oxia (a metadata store and coordination system) prior to 0.16.2 causes the full OIDC bearer token to be written in plaintext to application logs at DEBUG level whenever authentication fails. Anyone able to read those logs - via a compromised or shared log aggregation pipeline or misconfigured log access controls - can harvest valid JWTs (header, payload, and signature) and replay them to impersonate legitimate users. No public exploit identified at time of analysis; EPSS is low at 0.05%, and CISA SSVC records exploitation status as none.
Denial-of-service in Oxia (metadata store and coordination system) versions <= 0.16.1 allows a remote unauthenticated client to crash the entire data server process by racing rapid KeepAlive/heartbeat requests against session expiry or closure. The flaw is a concurrency bug (send on closed channel panic, or deadlock when the buffer fills) triggerable without authentication over the network. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC rates exploitation as none, but the low attack complexity makes it a credible availability threat once patched.
Incomplete PEM parsing in Oxia's TLS subsystem silently drops all but the first certificate from CA bundle files, breaking mutual TLS chain validation in all Oxia deployments prior to 0.16.2 that use the `trustedCaFile` option with a multi-certificate bundle. Legitimate clients presenting certificates signed by an intermediate CA are rejected with `x509: certificate signed by unknown authority`, creating operator pressure to disable client certificate verification entirely - degrading the mTLS security posture rather than enabling direct exploitation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.02% (6th percentile), but the indirect risk of operators weakening authentication to restore connectivity is the primary concern.
Authentication bypass in Oxia (oxia-db) metadata store and coordination system prior to 0.16.2 allows an attacker holding a valid OIDC/JWT token issued for a different service by the same identity provider to authenticate to Oxia. The OIDC provider unconditionally set SkipClientIDCheck: true in the go-oidc verifier, disabling library-level audience (aud) validation and breaking the audience/tenant isolation that OAuth2/OIDC relies on. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records no known exploitation, but the technical impact is rated total.
Sensitive information disclosure in Oxia (a metadata store and coordination system) prior to 0.16.2 causes the full OIDC bearer token to be written in plaintext to application logs at DEBUG level whenever authentication fails. Anyone able to read those logs - via a compromised or shared log aggregation pipeline or misconfigured log access controls - can harvest valid JWTs (header, payload, and signature) and replay them to impersonate legitimate users. No public exploit identified at time of analysis; EPSS is low at 0.05%, and CISA SSVC records exploitation status as none.
Denial-of-service in Oxia (metadata store and coordination system) versions <= 0.16.1 allows a remote unauthenticated client to crash the entire data server process by racing rapid KeepAlive/heartbeat requests against session expiry or closure. The flaw is a concurrency bug (send on closed channel panic, or deadlock when the buffer fills) triggerable without authentication over the network. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC rates exploitation as none, but the low attack complexity makes it a credible availability threat once patched.
Incomplete PEM parsing in Oxia's TLS subsystem silently drops all but the first certificate from CA bundle files, breaking mutual TLS chain validation in all Oxia deployments prior to 0.16.2 that use the `trustedCaFile` option with a multi-certificate bundle. Legitimate clients presenting certificates signed by an intermediate CA are rejected with `x509: certificate signed by unknown authority`, creating operator pressure to disable client certificate verification entirely - degrading the mTLS security posture rather than enabling direct exploitation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.02% (6th percentile), but the indirect risk of operators weakening authentication to restore connectivity is the primary concern.