Openidc vulnerabilities

Products

• Mod Auth Openidc 17
• Cjose 3
• Liboauth2 2

Newest

• openidc cjose OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Fix available 9.1 CriticalSeptember 8, 2026
• openidc cjose OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) CVE-2026-53938 Fix available 8.2 HighSeptember 8, 2026
• openidc mod auth openidc mod_auth_openidc has out-of-bounds read and write in state cookie parsing CVE-2026-54789 Fix available 7.5 HighJuly 19, 2026
• openidc liboauth2 Improper Data Validation in liboauth2 CVE-2026-54431 Fix available 5.1 MediumJuly 2, 2026
• openidc liboauth2 Server-Site Request Forgery in liboauth2 CVE-2026-54430 Fix available 5.1 MediumJuly 2, 2026
• openidc mod auth openidc mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVE-2025-31492 Fix available 8.2 HighApril 6, 2025
• debian linux, fedoraproject fedora, openidc mod auth openidc +2 more Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc CVE-2024-24814 Fix available 7.5 HighFebruary 13, 2024
• cisco cjose Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose CVE-2023-37464 Fix available 8.6 HighJuly 14, 2023
• openidc mod auth openidc mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied CVE-2023-28625 Fix available 7.5 HighApril 3, 2023
• debian linux, openidc mod auth openidc +1 more Open Redirect in oidc_validate_redirect_url() CVE-2022-23527 Fix available 4.7 MediumDecember 14, 2022
• debian linux, fedoraproject fedora, openidc mod auth openidc +2 more URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc CVE-2021-39191 Fix available 4.7 MediumSeptember 3, 2021
• fedoraproject fedora, openidc mod auth openidc +1 more XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc CVE-2021-32792 Fix available 3.1 LowJuly 26, 2021
• fedoraproject fedora, openidc mod auth openidc +1 more Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc CVE-2021-32791 Fix available 5.9 MediumJuly 26, 2021
• fedoraproject fedora, openidc mod auth openidc +1 more Open Redirect in oidc_validate_redirect_url() CVE-2021-32786 Fix available 4.7 MediumJuly 22, 2021
• debian linux, netapp cloud backup, openidc mod auth openidc +2 more Format string bug in the Redis cache implementation CVE-2021-32785 Fix available 5.3 MediumJuly 22, 2021
• fedoraproject fedora, openidc mod auth openidc, oracle essbase +2 more CVE-2021-20718 affecting package mod_auth_openidc for versions less than 2.4.14.2-1 CVE-2021-20718 Fix available 7.5 HighMay 20, 2021
• python openid connect project openid connect, openidc pyoidc +1 more Cryptographic issues in Python oic CVE-2020-26244 Fix available 6.8 MediumDecember 2, 2020
• debian linux, fedoraproject fedora, openidc mod auth openidc +1 more +3 more A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs... CVE-2019-20479 Fix available 6.1 MediumFebruary 20, 2020
• [unknown] mod auth openidc mod_auth_openidc before version 2.4.0.1 is vulnerable to a None CVE-2019-14857 Fix available 5.8 MediumNovember 8, 2019
• openidc mod auth openidc ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS).... CVE-2019-1010247 Fix available 6.1 MediumJuly 19, 2019
• openidc mod auth openidc Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka... CVE-2017-6059 Fix available 7.5 HighApril 12, 2017
• openidc mod auth openidc The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module... CVE-2017-6413 Fix available 8.6 HighMarch 2, 2017
• openidc mod auth openidc The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module... CVE-2017-6062 Fix available 8.6 HighMarch 2, 2017