CVE-2026-19363: lmammino oidc-authorizer Fixed Message handler.rs unwrap deserialization
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is the function unwrap of the file src/handler.rs of the component Fixed Message Handler. The manipulation of the argument jwtClaims results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19363?
The severity of CVE-2026-19363 is rated as medium with a score of 5.3.
How do I fix CVE-2026-19363?
To fix CVE-2026-19363, update the lmammino oidc-authorizer to version 0.4.1 or later.
Who is affected by CVE-2026-19363?
Users of lmammino oidc-authorizer versions prior to 0.4.1 are affected by CVE-2026-19363.
What type of exploitation does CVE-2026-19363 allow?
CVE-2026-19363 allows for remote deserialization attacks through manipulation of the jwtClaims argument.
What component contains the vulnerability in CVE-2026-19363?
The vulnerability in CVE-2026-19363 is found in the Fixed Message Handler function unwrap located in src/handler.rs.