MO
Product
mod_auth_openidc
16
CVEs
0
On KEV
8.6
Max CVSS
0
New 30D
Severity mix
Critical 0High 8Medium 8Low 0
Watch
Add mod_auth_openidc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-6413 | 8.6 | Mar 2 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and… Affected: through 2.1.5 |
| CVE-2017-6062 | 8.6 | Mar 2 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and… Affected: through 2.1.4 |
| CVE-2026-54789 | 7.5 | Aug 21 | mod_auth_openidc has out-of-bounds read and write in state cookie parsing Affected: < 2.4.19.4 |
| CVE-2024-24814 | 7.5 | Feb 13 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality Affected: 2.0.0 through 2.4.15.1 |
| CVE-2023-28625 | 7.5 | Apr 3 | mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality Affected: 2.0.0 before 2.4.13.2 |
| CVE-2021-32785 | 7.5 | Jul 22 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID… Affected: before 2.4.9 |
| CVE-2021-20718 | 7.5 | May 20 | mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors Affected: 2.4.0 through 2.4.7 |
| CVE-2017-6059 | 7.5 | Apr 12 | Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a… Affected: before 2.1.4 |
Showing 8