Red Hat Security Advisory: mod_auth_openidc security update
A vulnerability in the mod_auth_openidc module for Apache HTTP Server allows OIDCProviderAuthRequestMethod POST requests to leak protected data. This issue affects Red Hat Enterprise Linux 10 and its extended update support versions. The vulnerability is rated as important by Red Hat Product Security. An update addressing this issue is available from Red Hat.
AI Analysis
Technical Summary
The mod_auth_openidc module, which enables Apache HTTP Server to function as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server, contains a vulnerability (CVE-2025-31492) that allows protected data to be leaked via OIDCProviderAuthRequestMethod POST requests. Red Hat has issued a security advisory (RHSA-2025:7490) for Red Hat Enterprise Linux 10 and its extended update support variants, providing an update to fix this issue.
Potential Impact
The vulnerability permits leakage of protected data through specially crafted POST requests to the OIDCProviderAuthRequestMethod, potentially exposing sensitive authentication or authorization information. This could lead to unauthorized disclosure of protected data within affected systems running mod_auth_openidc on Red Hat Enterprise Linux 10.
Mitigation Recommendations
Red Hat has released an official security update for mod_auth_openidc in Red Hat Enterprise Linux 10 and its extended update support versions. Users should apply the update as detailed in the Red Hat advisory (RHSA-2025:7490) to remediate this vulnerability. Refer to https://access.redhat.com/articles/11258 for update instructions. Patch status is confirmed as available.
Red Hat Security Advisory: mod_auth_openidc security update
Description
A vulnerability in the mod_auth_openidc module for Apache HTTP Server allows OIDCProviderAuthRequestMethod POST requests to leak protected data. This issue affects Red Hat Enterprise Linux 10 and its extended update support versions. The vulnerability is rated as important by Red Hat Product Security. An update addressing this issue is available from Red Hat.
Affected software
pkg:rpm/redhat/mod_auth_openidcRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mod_auth_openidc module, which enables Apache HTTP Server to function as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server, contains a vulnerability (CVE-2025-31492) that allows protected data to be leaked via OIDCProviderAuthRequestMethod POST requests. Red Hat has issued a security advisory (RHSA-2025:7490) for Red Hat Enterprise Linux 10 and its extended update support variants, providing an update to fix this issue.
Potential Impact
The vulnerability permits leakage of protected data through specially crafted POST requests to the OIDCProviderAuthRequestMethod, potentially exposing sensitive authentication or authorization information. This could lead to unauthorized disclosure of protected data within affected systems running mod_auth_openidc on Red Hat Enterprise Linux 10.
Mitigation Recommendations
Red Hat has released an official security update for mod_auth_openidc in Red Hat Enterprise Linux 10 and its extended update support versions. Users should apply the update as detailed in the Red Hat advisory (RHSA-2025:7490) to remediate this vulnerability. Refer to https://access.redhat.com/articles/11258 for update instructions. Patch status is confirmed as available.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:7490
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a4049e827e9c7971983557d
Added to database: 06/27/2026, 22:08:40 UTC
Last enriched: 06/27/2026, 22:37:25 UTC
Last updated: 07/03/2026, 08:51:21 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.