What’s Vulnerable › Products

OpenIDC mod_auth_openidc vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your OpenIDC mod_auth_openidc version is affected

Latest OpenIDC mod_auth_openidc vulnerabilities

• CVE-2026-54789 — mod_auth_openidc has out-of-bounds read and write in state cookie parsing (CVSS 7.5)
• CVE-2025-31492 — mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVSS 8.2)
• CVE-2024-24814 — Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc (CVSS 7.5)
• CVE-2023-28625 — mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied (CVSS 7.5)
• CVE-2022-23527 — Open Redirect in oidc_validate_redirect_url() (CVSS 6.1)
• CVE-2021-39191 — URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc (CVSS 6.1)
• CVE-2021-32792 — XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc (CVSS 6.1)
• CVE-2021-32791 — Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc (CVSS 5.9)
• CVE-2021-32786 — Open Redirect in oidc_validate_redirect_url() (CVSS 6.1)
• CVE-2021-32785 — Format string bug in the Redis cache implementation (CVSS 7.5)
• CVE-2021-20718 — (CVSS 7.5)
• CVE-2019-20479 — (CVSS 6.1)
• CVE-2019-14857 — (CVSS 6.1)
• CVE-2019-1010247 — (CVSS 6.1)
• CVE-2017-6059 — (CVSS 7.5)
• CVE-2017-6413 — (CVSS 8.6)
• CVE-2017-6062 — (CVSS 8.6)