CVE-2026-54789: CWE-125: Out-of-bounds Read in OpenIDC mod_auth_openidc
Description
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
CVSS v3.1
Score 7.5high
Affected software
OpenIDC
mod_auth_openidc
pkg:github/openidc/mod_auth_openidcRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
mod_auth_openidc, an OpenID Connect authentication module for Apache HTTP Server, has a vulnerability (CVE-2026-54789) involving an out-of-bounds read and a one-byte out-of-bounds write in its state-cookie parser. This occurs in versions prior to 2.4.19.4 due to improper handling of tokens lacking '=' in Cookie headers. The issue is resolved in version 2.4.19.4 by stopping the scan at the string terminator to reject such malformed tokens. No direct in-product mitigations exist, but upstream filtering of malformed Cookie headers can reduce risk.
Potential Impact
The vulnerability can cause a denial of service (high impact on availability) due to out-of-bounds memory access in the state-cookie parser. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade mod_auth_openidc to version 2.4.19.4 or later where the vulnerability is fixed. No in-product workarounds exist. As a temporary measure, deploy an upstream reverse proxy or web application firewall (WAF) that rejects or normalizes malformed Cookie headers lacking '=' tokens to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T23:23:57.714Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a887b78acd9273b4962e1dd
Added to database: 08/21/2026, 16:23:20 UTC
Last enriched: 09/07/2026, 13:26:15 UTC
Last updated: 10/05/2026, 18:48:20 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.