Mod_auth_openidc

This hub aggregates every CVE we track for Mod_auth_openidc, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 13 most recently published vulnerabilities affecting Mod_auth_openidc.

• CVE-2025-3891Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled7.5Apr 29, 2025
• CVE-2025-31492mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data7.5Apr 6, 2025
• CVE-2024-24814Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc7.5Feb 13, 2024
• CVE-2023-28625mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied7.5Apr 3, 2023
• CVE-2022-23527Open Redirect in oidc_validate_redirect_url()4.7Dec 14, 2022
• CVE-2021-39191URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc4.7Sep 3, 2021
• CVE-2021-32791Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc5.9Jul 26, 2021
• CVE-2021-32792XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc3.1Jul 26, 2021
• CVE-2021-32785Format string bug in the Redis cache implementation5.3Jul 22, 2021
• CVE-2021-32786Open Redirect in oidc_validate_redirect_url()4.7Jul 22, 2021
• CVE-2021-20718mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.7.5May 20, 2021
• CVE-2019-14857A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.6.1Nov 26, 2019
• CVE-2019-1010247ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf ...6.1Jul 19, 2019