Description

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is the function unwrap of the file src/handler.rs of the component Fixed Message Handler. The manipulation of the argument jwtClaims results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T18:16:43.280Z",
  "pubdate": "2026-08-09T18:16:43.280Z",
  "executiveSummary": "A deserialization vulnerability has been identified in lmammino oidc-authorizer up to version 0.4.0, specifically within the Fixed Message Handler component. The flaw resides in the unwrap function of the src/handler.rs file and can be triggered via the manipulation of the jwtClaims argument. This security defect allows remote attackers to execute arbitrary deserialization attacks over the network without requiring prior authentication or elevated privileges. Publicly available exploits increase the operational risk associated with this flaw. The vendor was contacted early regarding the disclosure but failed to provide a response or official patch, leaving deployments exposed unless compensating controls or manual remediation are applied.",
  "technicalDetails": "The vulnerability stems from insecure handling and deserialization of untrusted input within the Fixed Message Handler component of lmammino oidc-authorizer up to version 0.4.0. Specifically, the root cause is located in the unwrap function inside the src/handler.rs source file. The function processes the jwtClaims argument derived from incoming requests without adequate validation or safe parsing mechanisms.\nThe attack vector is network-based, allowing remote adversaries to interact directly with the vulnerable service. An attacker crafts a malicious payload containing serialized data injected into the jwtClaims parameter. When the unwrap function processes this manipulated argument, it initiates unsafe deserialization routines.\nThe step-by-step attack flow involves the adversary identifying the network endpoint exposing the Fixed Message Handler, formulating a crafted request containing the malicious jwtClaims payload, and transmitting it across the network. Upon receipt, the src/handler.rs component passes the argument to the vulnerable unwrap function, which executes the unsafe deserialization process. This flaw enables remote code execution or state manipulation depending on the underlying data structures and dependencies utilized by the application.\nNo authentication or specific privilege levels are required to exploit this vulnerability, as the attack surface is exposed to remote unauthenticated entities interacting with the component. The availability of public exploit code lowers the barrier to entry for threat actors seeking to compromise vulnerable instances of lmammino oidc-authorizer."
}