RLSA-2026:92157: Critical: mod_auth_openidc:2.3 security update
The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/mod_auth_openidcto a version that resolves this vulnerability.Fixed in 0:2.4.9.4-9.module+el8.10.0+40373+8a3f15d2
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vector indicates that exploitation can be performed remotely over the network, with low attack complexity and no privileges or user interaction required.
What is the potential impact if the issue is exploited?
The issue is rated critical with a CVSS score of 9.1. It can result in high impact to confidentiality and integrity, while no availability impact is indicated.
Is a default deployment affected?
The provided data does not state whether default configurations are affected.