mod_auth_openidc has out-of-bounds read and write in state cookie parsing
Priority LOW 39CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed mod_auth_openidc (OpenIDC): 2.4.19.4Red Hat: 11 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA mod_auth_openidc (OpenIDC) Fixed in 2.4.19.4
Red Hat 11 advisories
- RHSA-2026:79177 Released 2026-10-08 · Red Hat rating Importantmod_auth_openidc security update
- Red Hat Enterprise Linux AppStream (v. 9) mod_auth_openidc-2.4.16.11-1.el9_8.1
- RHSA-2026:77369 Released 2026-10-07 · Red Hat rating Importantmod_auth_openidc:2.3 security update
- Red Hat Enterprise Linux AppStream (v. 8) cjose-0.6.1-5.module+el8.10.0+24880+4db9166e.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-5.module+el8.10.0+24880+4db9166e.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-5.module+el8.10.0+24880+4db9166e.s390x::mod_auth_openidc:2.3 +11
- RHSA-2026:75581 Released 2026-10-05 · Red Hat rating Importantmod_auth_openidc security update
- Red Hat Enterprise Linux AppStream (v. 10) mod_auth_openidc-2.4.16.11-1.el10_2.1
Show 8 more Red Hat advisories
- RHSA-2026:69716 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) mod_auth_openidc-2.4.10-1.el9_6.3
- RHSA-2026:69718 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) mod_auth_openidc-2.4.9.4-4.el9_4.3
- RHSA-2026:69720 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) mod_auth_openidc-2.4.9.4-1.el9_2.4
- RHSA-2026:69717 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc:2.3 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) cjose-0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+19464+578f4546.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3 +5
- Red Hat Enterprise Linux AppStream TUS (v.8.8) cjose-0.6.1-3.module+el8.8.0+19464+578f4546.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3 +2
- RHSA-2026:69715 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc security update
- Red Hat Enterprise Linux Server (v. 7 ELS) mod_auth_openidc-1.8.8-9.el7_9.2
- RHSA-2026:69719 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) mod_auth_openidc-2.4.15-4.el10_0.2
- RHSA-2026:69713 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc:2.3 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3 +2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3 +2
- RHSA-2026:69712 Released 2026-09-22 · Red Hat rating Importantmod_auth_openidc:2.3 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) cjose-0.6.1-3.module+el8.4.0+19462+14bde120.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3 +2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) cjose-0.6.1-3.module+el8.4.0+19462+14bde120.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3 +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:75581 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:77369 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:79177 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:69712 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:69713 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:69717 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:69720 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:69718 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:69719 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:69716 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:69712 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:69713 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:69717 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2026:69715 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54789
- 2026-10-05 Fix available: RHSA-2026:75581 · Red Hat
- 2026-10-05 Fix available: Red Hat Enterprise Linux AppStream (v. 10) · Red Hat
- 2026-10-07 EPSS moved to the below the 50th percentile
- 2026-10-07 Priority changed: MEDIUM → LOW
- 2026-10-07 Fix available: RHSA-2026:77369 · Red Hat
- 2026-10-08 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
- 2026-10-09 Fix available: RHSA-2026:79177 · Red Hat
- 2026-10-09 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
References
More OpenIDC vulnerabilities
- TI-2026-38908 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVSS 3.1CRITICAL 9.1
- TI-2024-16331 Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc CVSS 3.1HIGH 7.5
- TI-2023-19073 Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose CVSS 3.1HIGH 8.6
- TI-2017-04220 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
- TI-2017-03971 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
- TI-2025-22673 mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVSS 4.0HIGH 8.2
Sources
- CVE-2026-54789 · CVE Program
- CVE-2026-54789 · NVD
- FIRST EPSS
- CVE-2026-54789 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences