mod_auth_openidc vulnerabilities

4 known vulnerabilities in mod_auth_openidc from OpenIDC. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  mod_auth_openidc: Out-of-bounds Read

  CVE-2026-54789Aug 21, 2026OpenIDC

  mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in

• 8.2 High severity

  mod_auth_openidc: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-31492Apr 6, 2025OpenIDC

  mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected co

• 7.5 High severity

  mod_auth_openidc: Uncontrolled Resource Consumption

  CVE-2024-24814Feb 13, 2024OpenIDCEPSS 1.25%

  mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks coo

• 7.5 High severity

  mod_auth_openidc: NULL Pointer Dereference

  CVE-2023-28625Apr 3, 2023OpenIDCEPSS 1.32%

  mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NU