Vulnerability Description
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be
- https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-vgr5-qcpp-x
FAQ
What is CVE-2026-54789?
CVE-2026-54789 is a vulnerability with a CVSS score of 7.5 (HIGH). mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out...
How severe is CVE-2026-54789?
CVE-2026-54789 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54789?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.