CVE-2026-54789: high-severity vulnerability in OpenIDC mod_auth_openidc
mod_auth_openidc has out-of-bounds read and write in state cookie parsing
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OpenIDC · mod_auth_openidcRelated CVEs — OpenIDC mod_auth_openidc
In the same product, most dangerous first.
CVE-2023-28625HIGHmod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is suppliedEPSS 1.3%CVE-2024-24814HIGHDenial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidcEPSS 1.3%CVE-2025-31492HIGHmod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected dataEPSS 0.6%