mod_auth_openidc:2.3 security update

cjose 0.6.1-6 - CVE-2026-53939 modauthopenidc:2.3/cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287898 modauthopenidc 2.4.9.4-9 - Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state cookie parsing...

CLSA-2026-1792634626 mod_auth_openidc: Fix of CVE-2026-54789

CVE-2026-54789: fix out-of-bounds read/write in the state-cookie parser...

AlmaLinux 9.6 [TuxCare] Security Update: mod_auth_openidc (ALMALINUX9.6:CLSA-2026:1792634626)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792634626 advisory. - modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID...

Rocky Linux 9.6 [TuxCare] Security Update: mod_auth_openidc (ALMALINUX9.6:CLSA-2026:1792634626)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792634626 advisory. - modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID...

AlmaLinux 9.2 [TuxCare] Security Update: mod_auth_openidc (ALMALINUX9.2:CLSA-2026:1791839568)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791839568 advisory. - modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID...

CVE-2026-110008

The @fastify/oauth2 library (versions 7.2.0 through 8.3.1 ) is vulnerable to Login CSRF because state and code-verifier cookies are set without a Path attribute on routes with multiple segments. During the OAuth callback, the clearing step uses a root path, causing the original cookies to persist...

CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

EUVD-2026-104327

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

PT-2026-117386

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2026-2061:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2061:01 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 cjose: cjose: Heap buffer overflow in AES Key Wr...

AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2026:77369)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77369 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 cjose: cjose: Heap buffer overflow in AES Key Wrap...

MiracleLinux 9 : mod_auth_openidc-2.4.16.11-1.el9_8.1 (AXSA:2026-2041:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2041:01 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 Tenable has extracted the preceding description block...

CLSA-2026-1791839568 mod_auth_openidc: Fix of CVE-2026-54789

CVE-2026-54789: stop the state-cookie scan at the end of the cookie token so a state cookie without '=' cannot cause an out-of-bounds read/write...

Rocky Linux 9 [CIQ] Security Update: mod_auth_openidc / mod_auth_openidc-debuginfo / etc (crlsa-2026_79177)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202679177 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 Tenable has extracted the preceding description block directly...

RLSA-2026:79177 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

mod_auth_openidc security update

An update is available for modauthopenidc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for Apac...

mod_auth_openidc:2.3 security update

cjose 0.6.1-5 - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256961 modauthopenidc 2.4.9.4-9 - Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state cookie parsing...

RockyLinux 9 : mod_auth_openidc (RLSA-2026:79177)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:79177 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 Tenable has extracted the preceding description block directl...