🛡️ OESA-2026-3009 — mod-auth-openidc

mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).

Security Fix(es):

An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. oidc_state_cookies_parse_token() (src/state.c) scans a cookie token for the = that separates the cookie name from its value with a loop whose only real termination condition is finding a = byte — it does not stop at the string terminator. The cookie != NULL test can never become false, because cookie is only ever incremented (never reassigned to NULL). A request whose Cookie header contains a token that begins with the configured state-cookie prefix (default mod_auth_openidc_state_) but contains no = makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a = (0x3D) byte, and then writing a NUL byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the OIDCRedirectURI callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the Cookie header.(CVE-2026-54789)