CVE-2026-54789: mod_auth_openidc out-of-bounds read and write in state cookie parser

CVE-2026-54789 · Severity: high · CVSS 7.5 · Published 2026-08-21

mod_auth_openidc is an authentication module for Apache web servers that validates users via OpenID Connect. A defect in the cookie parsing logic allows an unauthenticated attacker to send malformed cookie headers that cause the parser to read and write memory beyond buffer boundaries, resulting in service crashes or potential data corruption on affected servers.

Vendors: Openidc.

Quick answers

Is CVE-2026-54789 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54789 being exploited in the wild.
How severe is CVE-2026-54789?
High severity, with a CVSS score of 7.5, published 21 August 2026.
Which products and versions are affected?
Openidc Mod Auth Openidc < 2.4.19.4.
Is there a fix for CVE-2026-54789?
A patch was published on 2026-08-21: version 2.4.19.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54789 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-54789?
Check whether you run Openidc Mod Auth Openidc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic out-of-bounds read/write (CWE-125, CWE-787) in the state-cookie parser function `oidc_state_cookies_parse_token()` in src/state.c. The parsing loop scans for an '=' character that separates cookie name from value but lacks a proper string-terminator check; it only increments the pointer and never reassigns it to NULL, so the loop continues past the buffer end until finding a '=' byte in adjacent memory, then writes a NUL byte at that out-of-bounds offset. An unauthenticated remote client can trigger this by sending a Cookie header with a token matching the state-cookie prefix but containing no '=' character. The parser executes early during new authentication flows and redirect-URI callbacks, before any session validation. Exploitation causes denial of service (crash if the read reaches an unmapped page) or limited heap/pool corruption. Version 2.4.19.4 fixes this by adding a string-terminator check to reject value-less tokens.

Affected products

  • OpenIDC mod_auth_openidc < 2.4.19.4

Timeline

  • 2026-07-02: disclosed
  • 2026-08-21: patched: version 2.4.19.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.