CVE-2026-54789

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be652a73a8630
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-vgr5-qcpp-x2pr
https://lists.debian.org/debian-lts-announce/2026/09/msg00003.html

Configurations

No configuration.

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) mod_auth_openidc es un módulo de autenticación y autorización certificado por OpenID para el servidor HTTP Apache 2.x que implementa la funcionalidad de Relying Party de OpenID Connect. Antes de la versión 2.4.19.4, existían una lectura fuera de límites y una escritura de un byte fuera de límites en el analizador de la cookie de estado de mod_auth_openidc. El problema se solucionó en la versión 2.4.19.4 deteniendo el escaneo en el terminador de cadena para que se rechace un token sin valor. No hay soluciones alternativas disponibles en el producto. Como medida provisional, un proxy inverso ascendente o un WAF que rechace o normalice encabezados 'Cookie' malformados (tokens que carecen de '=') puede reducir la exposición, pero la actualización es la remediación recomendada.

Information

Published : 2026-08-21 16:17

Updated : 2026-10-15 19:10

NVD link : CVE-2026-54789

Mitre link : CVE-2026-54789

CVE.ORG link : CVE-2026-54789

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-54789", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54789", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T17:23:33.836898Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenIDC", "product": "mod_auth_openidc", "versions": [{"status": "affected", "version": "< 2.4.19.4"}]}]}], "published": "2026-08-21T16:17:19.000", "references": [{"url": "https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be652a73a8630", "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-vgr5-qcpp-x2pr", "source": "security-advisories@github.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/09/msg00003.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation."}, {"lang": "es", "value": "mod_auth_openidc es un m\u00f3dulo de autenticaci\u00f3n y autorizaci\u00f3n certificado por OpenID para el servidor HTTP Apache 2.x que implementa la funcionalidad de Relying Party de OpenID Connect. Antes de la versi\u00f3n 2.4.19.4, exist\u00edan una lectura fuera de l\u00edmites y una escritura de un byte fuera de l\u00edmites en el analizador de la cookie de estado de mod_auth_openidc. El problema se solucion\u00f3 en la versi\u00f3n 2.4.19.4 deteniendo el escaneo en el terminador de cadena para que se rechace un token sin valor. No hay soluciones alternativas disponibles en el producto. Como medida provisional, un proxy inverso ascendente o un WAF que rechace o normalice encabezados 'Cookie' malformados (tokens que carecen de '=') puede reducir la exposici\u00f3n, pero la actualizaci\u00f3n es la remediaci\u00f3n recomendada."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "security-advisories@github.com"}