OpenIDC vulnerabilities
We track 7 vulnerabilities in OpenIDC products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest OpenIDC vulnerabilities
- 9.1 Critical severity
cjose: Use of Hard-coded Cryptographic Key
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`
- 8.2 High severity
cjose: Heap-based Buffer Overflow
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the len
- 7.5 High severity
mod_auth_openidc: Out-of-bounds Read
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in
- 8.2 High severity
mod_auth_openidc: Exposure of Sensitive Information to an Unauthorized Actor
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected co
- 7.5 High severity
mod_auth_openidc: Uncontrolled Resource Consumption
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks coo
- 7.5 High severity
cjose: Use of a Broken or Risky Cryptographic Algorithm
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets
- 7.5 High severity
mod_auth_openidc: NULL Pointer Dereference
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NU