CVE-2025-31492
mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
CVE-2025-31492- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2025-10018
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
EUVD-2025-10018- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
CVE-2025-31492- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
CVE-2025-31492- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-31492
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
DEBIAN-CVE-2025-31492- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVOESA-2025-1442
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.(CVE-2025-31492)
- Record
OESA-2025-1442- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 31 moreShow less
OSVOESA-2025-1443
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.(CVE-2025-31492)
- Record
OESA-2025-1443- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-1444
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.(CVE-2025-31492)
- Record
OESA-2025-1444- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-1445
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.(CVE-2025-31492)
- Record
OESA-2025-1445- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:3945
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:3945- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:3997
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:3997- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:4128
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:4128- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:4192
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:4192- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:4224
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:4224- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:4225
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:4225- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:4227
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:4227- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:4228
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:4228- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:7419
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:7419- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:7490
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:7490- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRLSA-2025:3997
Important: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:3997- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRLSA-2025:7419
Important: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:7419- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRLSA-2025:7490
Important: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:7490- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-31492
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
UBUNTU-CVE-2025-31492- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVALSA-2025:3997 No score
Important: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:3997- Updated
- 2026-11-02
OSVALSA-2025:7419 No score
Important: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:7419- Updated
- 2026-11-02
OSVALSA-2025:7490 No score
Important: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:7490- Updated
- 2026-11-02
OSVAZL-59592 No score
CVE-2025-31492 affecting package mod_auth_openidc 2.4.14.2-1
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
AZL-59592- Updated
- 2026-11-02
OSVAZL-61786 No score
CVE-2025-31492 affecting package mod_auth_openidc 2.4.14.2-2
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
- Record
AZL-61786- Updated
- 2026-11-05
OSVCLSA-2025-1746188656 No score
mod_auth_openidc: Fix of CVE-2025-31492
- CVE-2025-31492: fix vulnerability causing disclosure of protected content to unauthenticated users in mod_auth_openidc
- Record
CLSA-2025-1746188656- Updated
- 2026-11-02
OSVMGASA-2025-0147 No score
Updated apache-mod_auth_openidc packages fix security vulnerability
mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data. (CVE-2025-31492)
- Record
MGASA-2025-0147- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14972-1 No score
apache2-mod_auth_openidc-2.4.16.11-1.1 on GA media
These are all security issues fixed in the apache2-mod_auth_openidc-2.4.16.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14972-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1286-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. (bsc#1240893)
- Record
SUSE-SU-2025:1286-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1324-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. (bsc#1240893)
- Record
SUSE-SU-2025:1324-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1337-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. (bsc#1240893)
- Record
SUSE-SU-2025:1337-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1465-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. (bsc#1240893)
- Record
SUSE-SU-2025:1465-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4532-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- Update to 2.4.17.1 (bsc#1248806 / PED-14130).
- Remove many patches, as they've been merged upstream.
- Record
SUSE-SU-2025:4532-1- Updated
- 2026-11-02
OSVUSN-7446-1 No score
libapache2-mod-auth-openidc vulnerability
It was discovered that mod_auth_openidc incorrectly handled certain POST requests. An attacker could possibly use this issue to obtain sensitive information.
- Record
USN-7446-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cjoseAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
cjoseAlmaLinux:8 |
before 0.6.1-4.module_el8.10.0+3881+234adf82 | 0.6.1-4.module_el8.10.0+3881+234adf82 |
cjose-develAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
cjose-develAlmaLinux:8 |
before 0.6.1-4.module_el8.10.0+3881+234adf82 | 0.6.1-4.module_el8.10.0+3881+234adf82 |
mod_auth_openidcAlmaLinux:8 |
before 2.4.9.4-7.module_el8.10.0+3978+e883c40d | 2.4.9.4-7.module_el8.10.0+3978+e883c40d |
mod_auth_openidcAlmaLinux:9 |
before 2.4.10-1.el9_6.1 | 2.4.10-1.el9_6.1 |
mod_auth_openidcAlmaLinux:10 |
before 2.4.15-4.el10_0.1 | 2.4.15-4.el10_0.1 |
mod_auth_openidcAzure Linux:2 |
through 2.4.14.2-1 | None known |
mod_auth_openidcAzure Linux:3 |
through 2.4.14.2-2 | None known |
mod_auth_openidcTuxCare:AlmaLinux:9.2 |
before 2.4.9.4-1.el9.tuxcare.els2 | 2.4.9.4-1.el9.tuxcare.els2 |
Show 120 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-openidcDebian:12 |
before 2.4.12.3-2+deb12u3, plus listed versions 2.4.12.3-22.4.12.3-2+deb12u12.4.12.3-2+deb12u2 |
2.4.12.3-2+deb12u3 |
libapache2-mod-auth-openidcDebian:13 |
before 2.4.16.11-1 | 2.4.16.11-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.4.16.11-1 | 2.4.16.11-1 |
libapache2-mod-auth-openidcDebian:11 |
before 2.4.9.4-0+deb11u5, plus listed versions 2.4.9-12.4.9.4-0+deb11u12.4.9.4-0+deb11u22.4.9.4-0+deb11u32.4.9.4-0+deb11u4 |
2.4.9.4-0+deb11u5 |
apache-mod_auth_openidcMageia:9 |
before 2.4.13.2-1.2.mga9 | 2.4.13.2-1.2.mga9 |
mod_auth_openidcopenEuler:22.03-LTS-SP3 |
before 2.4.16.11-1.oe2203sp3 | 2.4.16.11-1.oe2203sp3 |
mod_auth_openidcopenEuler:22.03-LTS-SP4 |
before 2.4.16.11-1.oe2203sp4 | 2.4.16.11-1.oe2203sp4 |
mod_auth_openidcopenEuler:24.03-LTS |
before 2.4.16.11-1.oe2403 | 2.4.16.11-1.oe2403 |
mod_auth_openidcopenEuler:24.03-LTS-SP1 |
before 2.4.16.11-1.oe2403sp1 | 2.4.16.11-1.oe2403sp1 |
mod_auth_openidcRed Hat:rhel_e4s:9.0::appstream |
before 0:2.4.9.4-1.el9_0.2 | 0:2.4.9.4-1.el9_0.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_e4s:9.0::appstream |
before 0:2.4.9.4-1.el9_0.2 | 0:2.4.9.4-1.el9_0.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_e4s:9.0::appstream |
before 0:2.4.9.4-1.el9_0.2 | 0:2.4.9.4-1.el9_0.2 |
cjoseRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-develRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
mod_auth_openidcRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066 | 0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066 | 0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066 | 0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066 |
cjoseRed Hat:rhel_eus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-debuginfoRed Hat:rhel_eus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-debugsourceRed Hat:rhel_eus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-develRed Hat:rhel_eus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
mod_auth_openidcRed Hat:rhel_eus:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23028+2aae5ce6.1 | 0:2.4.9.4-1.module+el8.8.0+23028+2aae5ce6.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_eus:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23028+2aae5ce6.1 | 0:2.4.9.4-1.module+el8.8.0+23028+2aae5ce6.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_eus:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23028+2aae5ce6.1 | 0:2.4.9.4-1.module+el8.8.0+23028+2aae5ce6.1 |
cjoseRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debuginfoRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debugsourceRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-develRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
mod_auth_openidcRed Hat:rhel_aus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_aus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_aus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
cjoseRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debuginfoRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debugsourceRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-develRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
mod_auth_openidcRed Hat:rhel_e4s:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_e4s:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_e4s:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
cjoseRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debuginfoRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debugsourceRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-develRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
mod_auth_openidcRed Hat:rhel_tus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_tus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_tus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 | 0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1 |
mod_auth_openidcRed Hat:rhel_eus:9.4::appstream |
before 0:2.4.9.4-4.el9_4.1 | 0:2.4.9.4-4.el9_4.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_eus:9.4::appstream |
before 0:2.4.9.4-4.el9_4.1 | 0:2.4.9.4-4.el9_4.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_eus:9.4::appstream |
before 0:2.4.9.4-4.el9_4.1 | 0:2.4.9.4-4.el9_4.1 |
mod_auth_openidcRed Hat:rhel_eus:9.2::appstream |
before 0:2.4.9.4-1.el9_2.2 | 0:2.4.9.4-1.el9_2.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_eus:9.2::appstream |
before 0:2.4.9.4-1.el9_2.2 | 0:2.4.9.4-1.el9_2.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_eus:9.2::appstream |
before 0:2.4.9.4-1.el9_2.2 | 0:2.4.9.4-1.el9_2.2 |
cjoseRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debuginfoRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debugsourceRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-develRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
mod_auth_openidcRed Hat:rhel_aus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_aus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_aus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
cjoseRed Hat:rhel_e4s:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debuginfoRed Hat:rhel_e4s:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debugsourceRed Hat:rhel_e4s:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-develRed Hat:rhel_e4s:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
mod_auth_openidcRed Hat:rhel_e4s:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_e4s:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_e4s:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
cjoseRed Hat:rhel_tus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debuginfoRed Hat:rhel_tus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debugsourceRed Hat:rhel_tus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-develRed Hat:rhel_tus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
mod_auth_openidcRed Hat:rhel_tus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
mod_auth_openidc-debuginfoRed Hat:rhel_tus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
mod_auth_openidc-debugsourceRed Hat:rhel_tus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 | 0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1 |
cjoseRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
cjose-debuginfoRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
cjose-debugsourceRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
cjose-develRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
mod_auth_openidcRed Hat:rhel_aus:8.2::appstream |
before 0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6 | 0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6 |
mod_auth_openidc-debuginfoRed Hat:rhel_aus:8.2::appstream |
before 0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6 | 0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6 |
mod_auth_openidc-debugsourceRed Hat:rhel_aus:8.2::appstream |
before 0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6 | 0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6 |
mod_auth_openidcRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9_6.1 | 0:2.4.10-1.el9_6.1 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9_6.1 | 0:2.4.10-1.el9_6.1 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9_6.1 | 0:2.4.10-1.el9_6.1 |
mod_auth_openidcRed Hat:enterprise_linux:10.0 |
before 0:2.4.15-4.el10_0.1 | 0:2.4.15-4.el10_0.1 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:10.0 |
before 0:2.4.15-4.el10_0.1 | 0:2.4.15-4.el10_0.1 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:10.0 |
before 0:2.4.15-4.el10_0.1 | 0:2.4.15-4.el10_0.1 |
cjoseRocky Linux:8 |
before 0:0.6.1-4.module+el8.9.0+1384+4b58c166 | 0:0.6.1-4.module+el8.9.0+1384+4b58c166 |
mod_auth_openidcRocky Linux:8 |
before 0:2.4.9.4-7.module+el8.10.0+1953+b76d6417 | 0:2.4.9.4-7.module+el8.10.0+1953+b76d6417 |
mod_auth_openidcRocky Linux:9 |
before 0:2.4.10-1.el9_6.1 | 0:2.4.10-1.el9_6.1 |
mod_auth_openidcRocky Linux:10 |
before 0:2.4.15-4.el10_0.1 | 0:2.4.15-4.el10_0.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.3.8-150600.16.8.1 | 2.3.8-150600.16.8.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.3.8-150600.16.8.1 | 2.3.8-150600.16.8.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Manager Proxy 4.3 |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Manager Server 4.3 |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Enterprise Storage 7.1 |
before 2.3.8-150100.3.31.1 | 2.3.8-150100.3.31.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 2.4.0-7.15.1 | 2.4.0-7.15.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 2.4.0-7.15.1 | 2.4.0-7.15.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 2.4.0-7.19.1 | 2.4.0-7.19.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 2.4.0-7.19.1 | 2.4.0-7.19.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
libapache2-mod-auth-openidcUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-12.3.1-22.3.2-12.3.2-1build12.3.3-1build1 |
None known |
libapache2-mod-auth-openidcUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.10.2-12.4.0.4-12.4.1-1 |
None known |
libapache2-mod-auth-openidcUbuntu:22.04:LTS |
before 2.4.11-1ubuntu0.1, plus listed versions 2.4.9-12.4.9.4-12.4.10-12.4.10-1build12.4.11-1 |
2.4.11-1ubuntu0.1 |
libapache2-mod-auth-openidcUbuntu:24.04:LTS |
before 2.4.15.1-1ubuntu0.1, plus listed versions 2.4.14.2-12.4.14.4-22.4.14.4-2build12.4.15.1-12.4.15.1-1build22.4.15.1-1build3 |
2.4.15.1-1ubuntu0.1 |
libapache2-mod-auth-openidcUbuntu:25.10 |
All versions, plus listed versions 2.4.16.10-12.4.17-1 |
None known |
apache2-mod_auth_openidcopenSUSE:Tumbleweed |
before 2.4.16.11-1.1 | 2.4.16.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-31492 is a high vulnerability (CVSS 8.2) in Openidc Mod Auth Openidc, published April 6, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in cjose 0.6.1-4.module_el8.9.0+3631+0ced13d7.
References
github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r
lists.debian.org/debian-lts-announce/2025/04/msg00025.html
access.redhat.com/errata/RHSA-2025:3997
bugzilla.redhat.com/2357738
Show 63 moreShow less
errata.almalinux.org/8/ALSA-2025-3997.html
nvd.nist.gov/vuln/detail/CVE-2025-31492
errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1746188656.html
security-tracker.debian.org/tracker/CVE-2025-31492
advisories.mageia.org/MGASA-2025-0147.html
bugs.mageia.org/show_bug.cgi?id=34216
lists.opensuse.org/archives/list/[email protected]/message/4RNEMKHJH72IHWVOIEQAKSXHOSDXQN3A
lists.fedoraproject.org/archives/list/[email protected]/message/3Z7RSITAKS2ICGANCQP2TDUHMS2LZDXR
ubuntu.com/security/notices/USN-7446-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1442
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3945.json
cve.org/CVERecord?id=CVE-2025-31492
errata.rockylinux.org/RLSA-2025:3997
suse.com/support/update/announcement/2025/suse-su-20251286-1
bugzilla.suse.com/1240893