Executive brief
mod_auth_openidc is an authentication module for Apache web servers that validates users via OpenID Connect. A defect in the cookie parsing logic allows an unauthenticated attacker to send malformed cookie headers that cause the parser to read and write memory beyond buffer boundaries, resulting in service crashes or potential data corruption on affected servers.
Technical details
The vulnerability is a classic out-of-bounds read/write (CWE-125, CWE-787) in the state-cookie parser function `oidc_state_cookies_parse_token()` in src/state.c. The parsing loop scans for an '=' character that separates cookie name from value but lacks a proper string-terminator check; it only increments the pointer and never reassigns it to NULL, so the loop continues past the buffer end until finding a '=' byte in adjacent memory, then writes a NUL byte at that out-of-bounds offset. An unauthenticated remote client can trigger this by sending a Cookie header with a token matching the state-cookie prefix but containing no '=' character. The parser executes early during new authentication flows and redirect-URI callbacks, before any session validation. Exploitation causes denial of service (crash if the read reaches an unmapped page) or limited heap/pool corruption. Version 2.4.19.4 fixes this by adding a string-terminator check to reject value-less tokens.
Affected products
- OpenIDC mod_auth_openidc < 2.4.19.4
Timeline
- 2026-07-02: disclosed
- 2026-08-21: patched: version 2.4.19.4