Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
mod_auth_openidc can leak data via POST requests
published 1 year ago
Summary
The mod_auth_openidc module for Apache on AlmaLinux can unintentionally expose protected information when it sends POST requests to an OpenID Connect provider. This could allow an attacker to view data that should remain private. Apply the latest security update for almalinux/mod_auth_openidc as soon as possible to stop the leak.
What to do
- Update almalinux cjose to version 0.6.1-4.module_el8.9.0+3631+0ced13d7.
- Update almalinux cjose to version 0.6.1-4.module_el8.10.0+3881+234adf82.
- Update almalinux cjose-devel to version 0.6.1-4.module_el8.9.0+3631+0ced13d7.
- Update almalinux cjose-devel to version 0.6.1-4.module_el8.10.0+3881+234adf82.
- Update almalinux mod_auth_openidc to version 2.4.9.4-7.module_el8.10.0+3978+e883c40d.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | cjose |
< 0.6.1-4.module_el8.9.0+3631+0ced13d7 < 0.6.1-4.module_el8.10.0+3881+234adf82 Fix: upgrade to 0.6.1-4.module_el8.9.0+3631+0ced13d7
|
| AlmaLinux:8 | almalinux | cjose-devel |
< 0.6.1-4.module_el8.9.0+3631+0ced13d7 < 0.6.1-4.module_el8.10.0+3881+234adf82 Fix: upgrade to 0.6.1-4.module_el8.9.0+3631+0ced13d7
|
| AlmaLinux:8 | almalinux | mod_auth_openidc |
< 2.4.9.4-7.module_el8.10.0+3978+e883c40d Fix: upgrade to 2.4.9.4-7.module_el8.10.0+3978+e883c40d
|
Original advisory text
Important: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
* mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:3997 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-31492 Third Party Advisory
- https://bugzilla.redhat.com/2357738 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2025-3997.html Vendor Advisory
Timeline
Published17 Apr 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:3997 · OSV
Track software like this
Free during beta