Vendor
Openidc
23 known vulnerabilities in products by Openidc, 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2017-6413 | Openidc Mod Auth Openidc: Authentication Bypass | 8.6 | |
| High | CVE-2017-6062 | Openidc Mod Auth Openidc: Authentication Bypass | 8.6 | |
| High | CVE-2017-6059 | Openidc Mod Auth Openidc: security vulnerability | 7.5 | |
| High | CVE-2021-20718 | ZmartZone Mod Auth Openidc: Denial of Service | 7.5 | |
| High | CVE-2021-32785 | Format string bug in the Redis cache implementation | 5.3 | |
| High | CVE-2026-54789 | mod_auth_openidc has out-of-bounds read and write in state cookie parsing | 7.5 | |
| Medium | CVE-2019-20479 | Openidc Mod Auth Openidc: Open Redirect | 6.1 | |
| High | CVE-2024-24814 | Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc | 7.5 | |
| High | CVE-2023-28625 | mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied | 7.5 | |
| Medium | CVE-2021-32786 | Open Redirect in oidc_validate_redirect_url() | 4.7 | |
| Critical | CVE-2026-53939 | OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption | 9.1 | |
| Medium | CVE-2019-14857 | Mod Auth Openidc: Open Redirect | 5.8 | |
| Medium | CVE-2021-32791 | Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc | 5.9 | |
| High | CVE-2026-53938 | OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) | 8.2 | |
| Medium | CVE-2021-39191 | URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc | 4.7 | |
| Medium | CVE-2019-1010247 | ZmartZone IAM Mod Auth Openidc: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2023-37464 | Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose | 8.6 | |
| High | CVE-2025-31492 | mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data | — | |
| Medium | CVE-2020-26244 | Cryptographic issues in Python oic | 6.8 | |
| Medium | CVE-2021-32792 | XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc | 3.1 | |
| Medium | CVE-2022-23527 | Open Redirect in oidc_validate_redirect_url() | 4.7 | |
| Medium | CVE-2026-54431 | Improper Data Validation in liboauth2 | — | |
| Medium | CVE-2026-54430 | Server-Site Request Forgery in liboauth2 | — |
Products
| Mod Auth Openidc | 17 | 0 |
| Cjose | 3 | 0 |