Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat mod_auth_openidc may allow unauthorized access

published 1 month ago

Summary

The mod_auth_openidc module in Red Hat systems can be tricked into accepting false login credentials, potentially letting attackers act as legitimate users. This risk also affects related libraries such as cjose and its development packages. Install the provided Red Hat security update promptly to protect your environment.

What to do

Update redhat cjose to version 0:0.6.1-3.module+el8.4.0+19462+14bde120.
Update redhat cjose-debuginfo to version 0:0.6.1-3.module+el8.4.0+19462+14bde120.
Update redhat cjose-debugsource to version 0:0.6.1-3.module+el8.4.0+19462+14bde120.
Update redhat cjose-devel to version 0:0.6.1-3.module+el8.4.0+19462+14bde120.
Update redhat mod_auth_openidc to version 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3.
Update redhat mod_auth_openidc-debuginfo to version 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3.
Update redhat mod_auth_openidc-debugsource to version 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_aus:8.4::appstream	redhat	cjose	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_aus:8.4::appstream	redhat	cjose-debuginfo	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_aus:8.4::appstream	redhat	cjose-debugsource	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_aus:8.4::appstream	redhat	cjose-devel	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_aus:8.4::appstream	redhat	mod_auth_openidc	< 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 Fix: upgrade to 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
Red Hat:rhel_aus:8.4::appstream	redhat	mod_auth_openidc-debuginfo	< 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 Fix: upgrade to 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
Red Hat:rhel_aus:8.4::appstream	redhat	mod_auth_openidc-debugsource	< 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 Fix: upgrade to 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
Red Hat:rhel_eus_long_life:8.4::appstream	redhat	cjose	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_eus_long_life:8.4::appstream	redhat	cjose-debuginfo	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_eus_long_life:8.4::appstream	redhat	cjose-debugsource	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_eus_long_life:8.4::appstream	redhat	cjose-devel	< 0:0.6.1-3.module+el8.4.0+19462+14bde120 Fix: upgrade to 0:0.6.1-3.module+el8.4.0+19462+14bde120
Red Hat:rhel_eus_long_life:8.4::appstream	redhat	mod_auth_openidc	< 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 Fix: upgrade to 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
Red Hat:rhel_eus_long_life:8.4::appstream	redhat	mod_auth_openidc-debuginfo	< 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 Fix: upgrade to 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
Red Hat:rhel_eus_long_life:8.4::appstream	redhat	mod_auth_openidc-debugsource	< 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 Fix: upgrade to 0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3

Original advisory text

Red Hat Security Advisory: mod_auth_openidc:2.3 security update

References

https://access.redhat.com/errata/RHSA-2026:69712 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2521051 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69712.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-54789 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-54789 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54789 Vendor Advisory
https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be... Third Party Advisory
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-vgr5-qcpp-x... Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published22 Sep 2026

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2026:69712 · OSV

Track software like this

Free during beta