CVE-2026-54789: mod_auth_openidc has out-of-bounds read and write in state cookie parsing
modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed Cookie headers (tokens lacking =) can reduce exposure, but upgrading is the recommended remediation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mod_auth_openidcto a version that resolves this vulnerability.Fixed in 2.4.19.4 - Compensating control
Use an upstream reverse proxy or WAF to reject or normalize malformed Cookie headers where tokens lack `=` to reduce exposure while upgrading.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running mod_auth_openidc before version 2.4.19.4 are affected. The vulnerable code is the module's state-cookie parser.
What must an attacker do to exploit the issue?
An attacker can send a malformed Cookie header containing a token without an equals sign. The issue is remotely reachable and requires no privileges or user interaction according to the supplied vector.
Is there a workaround if an upgrade cannot be applied immediately?
There is no in-product workaround. As a temporary measure, place an upstream reverse proxy or WAF in front of the service to reject or normalize malformed Cookie headers, specifically tokens lacking '='.
How can I remediate the vulnerability?
Upgrade mod_auth_openidc to version 2.4.19.4 or later. This release stops parsing at the string terminator and rejects value-less tokens.