CVE-2026-54789
Received Received - Intake

Out-of-Bounds Read Write in mod_auth_openidc

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-54789
EUVD
EUVD-2026-64000

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openidc mod_auth_openidc to 2.4.19.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54789 is a vulnerability in mod_auth_openidc versions before 2.4.19.4. It involves an out-of-bounds read and write in the state cookie parser function. The parser scans cookie tokens for an equals sign (=) but fails to stop at the string terminator, causing it to read beyond the buffer and write a null byte outside allocated memory. This can crash the server or corrupt memory, leading to a denial of service.

Detection Guidance

To detect this vulnerability, inspect Apache HTTP server logs for crashes or errors related to mod_auth_openidc, particularly when processing malformed Cookie headers. Check for tokens in Cookie headers starting with 'mod_auth_openidc_state_' lacking an equals sign (=). Use tools like grep to search logs for patterns like 'state_cookies_parse_token' or 'out-of-bounds' errors.

Impact Analysis

An unauthenticated remote attacker could exploit this by sending a malformed Cookie header with a state cookie token missing an equals sign. This may cause the server to crash or experience memory corruption, resulting in a denial of service. Confidentiality impact is low as the read data is not returned to the attacker.

Compliance Impact

This vulnerability primarily impacts availability by causing service disruptions. While it does not directly expose sensitive data, repeated crashes or instability could violate availability requirements in GDPR or HIPAA. Organizations should prioritize patching to maintain compliance with uptime and reliability standards.

Mitigation Strategies

Immediately upgrade mod_auth_openidc to version 2.4.19.4 or later. If upgrading is not immediately possible, deploy an upstream reverse proxy or WAF to reject malformed Cookie headers, particularly those lacking an equals sign (=). Monitor for crashes or unusual memory errors in Apache logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart