Oauth-server-container: oauth-server-container logs client secret in debug level
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.9epss 0.4%
exploitation probability
0.4%top 71% of all CVEs
observed exploitation
nono source reports it
In short
The OAuth-server application accidentally logs sensitive client secrets to debug logs when debugging is enabled for certain login services. This means anyone with access to debug logs could see credentials needed to impersonate the application.
Technical detail
CWE-1295 (Improper Handling of Insufficient Entropy in TRNG) manifests as credential exposure in debug output. When logLevel is set to Debug or higher for OIDC/GitHub/GitLab/Google IdP configurations, OAuth2 client secrets are written to logs. An attacker with read access to application logs can extract these credentials and abuse them for authentication bypass or token manipulation.
Summary generated and translated by AI from the official description.
A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N