OP
Vendor
OpenIDC
21
CVEs
0
On KEV
0
New 30D
Products
MO8.6
mod_auth_openidc
OpenIDC
17 CVEs0 on KEV0 new
CJ9.1
cjose
OpenIDC
2 CVEs0 on KEV0 new
LI5.1
liboauth2
OpenIDC
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-53939 | CJ cjose OpenIDC | 9.1 | Sep 8 | OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption |
| CVE-2026-53938 | CJ cjose OpenIDC | 8.2 | Sep 8 | OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) |
| CVE-2026-54789 | MO mod_auth_openidc OpenIDC | 7.5 | Aug 21 | mod_auth_openidc has out-of-bounds read and write in state cookie parsing |
| CVE-2026-54431 | LI liboauth2 OpenIDC | 5.1 | Jul 2 | Improper Data Validation in liboauth2 |
| CVE-2026-54430 | LI liboauth2 OpenIDC | 5.1 | Jul 2 | Server-Site Request Forgery in liboauth2 |
| CVE-2025-31492 | MO mod_auth_openidc OpenIDC | 8.2 | Apr 6 | mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data |
| CVE-2024-24814 | MA Mod Auth Openidc Openidc | 7.5 | Feb 13 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality |
| CVE-2023-28625 | MA Mod Auth Openidc Openidc | 7.5 | Apr 3 | mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality |
| CVE-2022-23527 | MA Mod Auth Openidc Openidc | 6.1 | Dec 14 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server |
| CVE-2021-39191 | MA Mod Auth Openidc Openidc | 6.1 | Sep 3 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID… |
| CVE-2021-32792 | MA Mod Auth Openidc Openidc | 6.1 | Jul 26 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID… |
| CVE-2021-32791 | MA Mod Auth Openidc Openidc | 5.9 | Jul 26 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID… |
| CVE-2021-32786 | MA Mod Auth Openidc Openidc | 6.1 | Jul 22 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID… |
| CVE-2021-32785 | MA Mod Auth Openidc Openidc | 7.5 | Jul 22 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID… |
| CVE-2021-20718 | MA Mod Auth Openidc Openidc | 7.5 | May 20 | mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors |
| CVE-2019-20479 | MA Mod Auth Openidc Openidc | 6.1 | Feb 20 | A flaw was found in mod_auth_openidc before version 2.4.1 |
| CVE-2019-14857 | MA Mod Auth Openidc Openidc | 6.1 | Nov 26 | A flaw was found in mod_auth_openidc before version 2.4.0.1 |
| CVE-2019-1010247 | MA Mod Auth Openidc Openidc | 6.1 | Jul 19 | ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS) |
| CVE-2017-6059 | MA Mod Auth Openidc Openidc | 7.5 | Apr 12 | Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a… |
| CVE-2017-6413 | MA Mod Auth Openidc Openidc | 8.6 | Mar 2 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and… |
| CVE-2017-6062 | MA Mod Auth Openidc Openidc | 8.6 | Mar 2 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and… |