7.5

CVE-2026-54789: openidc mod_auth_openidc Out-of-bounds Read

CVSS: 7.5v3.1HighDeferred
AliasesMGASA-2026-0381SUSE-SU-2026:23593-1SUSE-SU-2026:3915-1
Published 21-08-2026Last modified 02-09-2026
Open JSON

Vulnerability summary

CVE-2026-54789 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in openidc mod_auth_openidc. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.49%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
RHSA-2026:77369

Timeline

  1. 21-08-2026
    PublishedVulnerability first disclosed.
  2. 02-09-2026
    Last modifiedVulnerability information updated.

Description

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

0.00 pp

From 0.49% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse15 products
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.4.17.1-150100.3.40.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.4.17.1-150100.3.40.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.4.17.1-150100.3.40.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 2.4.17.1-150100.3.40.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7< 2.4.17.1-150600.16.20.1
Redhat7 products
  • cjose< 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.8.0+19464+578f4546
  • cjose-debuginfo< 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.8.0+19464+578f4546
  • cjose-debugsource< 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.8.0+19464+578f4546
  • cjose-devel< 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.8.0+19464+578f4546
  • mod_auth_openidc< 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 | < 0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3 | < 0:1.8.8-9.el7_9.2 | < 0:2.4.10-1.el9_6.3 | < 0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3 | < 0:2.4.9.4-4.el9_4.3 | < 0:2.4.15-4.el10_0.2 | < 0:2.4.9.4-1.el9_2.4 | < 0:2.4.16.11-1.el10_2.1 | < 0:2.4.16.11-1.el9_8.1
Mageia2 products
  • apache-mod_auth_openidc< 2.4.20.2-1.mga10
  • apache-mod_auth_openidc< 2.4.20.2-1.mga9
Opensuse2 products
  • apache2-mod_auth_openidc&distro=openSUSE Leap 16.0< 2.4.17.1-160000.2.1
  • apache2-mod_auth_openidc&distro=openSUSE Tumbleweed< 2.4.20.2-1.1
Debian1 product
  • libapache2-mod-auth-openidc< 2.4.12.3-2+deb12u5 | < 2.4.17-1+deb13u1 | < 2.4.19.4-1
Openidc1 product
Ubuntu1 product
  • libapache2-mod-auth-openidcAll versions (No fix recorded)

7 vendors · 29 products

References

39 links
Show all 39 references