https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:03:45 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:3997 <p><strong>Affected:</strong> AlmaLinux:8: cjose, AlmaLinux:8: cjose-devel, AlmaLinux:8: mod_auth_openidc</p> <p>The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.</p> <p>Security Fix(es):</p> <p>* mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: cjose, AlmaLinux:8: cjose-devel, AlmaLinux:8: mod_auth_openidc</p> <p>The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.</p> <p>Security Fix(es):</p> <p>* mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:3997 https://cve.radiocsirt.org/vuln/bdu:2025-11077 bdu:2025-11077 https://cve.radiocsirt.org/vuln/bdu:2025-11077 https://cve.radiocsirt.org/vuln/euvd-2026-231356 EUVD-2026-231356 https://cve.radiocsirt.org/vuln/euvd-2026-231356 https://cve.radiocsirt.org/vuln/fkie_cve-2025-31492 <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn&#39;t be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn&#39;t check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions &gt;= 2.4.16.11.</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn&#39;t be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn&#39;t check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions &gt;= 2.4.16.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-31492 https://cve.radiocsirt.org/vuln/oesa-2025-1442 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: mod_auth_openidc</p> <p>This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP). Security Fix(es):</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn&amp;apos;t be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn&amp;apos;t check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions &amp;gt;=…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: mod_auth_openidc</p> <p>This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP). Security Fix(es):</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn&amp;apos;t be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn&amp;apos;t check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions &amp;gt;=…</p> https://cve.radiocsirt.org/vuln/oesa-2025-1442 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14972-1 <p>apache2-mod_auth_openidc-2.4.16.11-1.1 on GA media</p> <p>apache2-mod_auth_openidc-2.4.16.11-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14972-1 https://cve.radiocsirt.org/vuln/rhsa-2025:3945 <p>mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data</p> <p>mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data</p> https://cve.radiocsirt.org/vuln/rhsa-2025:3945 https://cve.radiocsirt.org/vuln/suse-su-2025:1286-1 <p>Security update for apache2-mod_auth_openidc</p> <p>Security update for apache2-mod_auth_openidc</p> https://cve.radiocsirt.org/vuln/suse-su-2025:1286-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-31492 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc, Ubuntu:22.04:LTS: libapache2-mod-auth-openidc, Ubuntu:24.04:LTS: libapache2-mod-auth-openidc, Ubuntu:25.10: libapache2-mod-auth-openidc</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn&#39;t be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn&#39;t check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions &gt;= 2.4.16.11.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc, Ubuntu:22.04:LTS: libapache2-mod-auth-openidc, Ubuntu:24.04:LTS: libapache2-mod-auth-openidc, Ubuntu:25.10: libapache2-mod-auth-openidc</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn&#39;t be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn&#39;t check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions &gt;= 2.4.16.11.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-31492 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0836 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in mod_auth_openidc ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in mod_auth_openidc ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0836