OOpenIDC

Products

Exploited and recent CVEs

• CVE-2026-53939 Critical 9.1 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption 0.2%
• CVE-2026-53938 High 8.2 OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) 0.2%
• CVE-2026-54789 High 7.5 mod_auth_openidc has out-of-bounds read and write in state cookie parsing 0.5%
• CVE-2026-54431 Medium 5.1 Improper Data Validation in liboauth2 0.2%
• CVE-2026-54430 Medium 5.1 Server-Site Request Forgery in liboauth2 0.2%
• CVE-2025-31492 High 8.2 mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data 0.6%
• CVE-2024-24814 High 7.5 Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc 1.2%
• CVE-2023-37464 High 8.6 Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose 0.7%
• CVE-2023-28625 High 7.5 mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied 1.3%
• CVE-2020-26244 Medium 6.8 Cryptographic issues in Python oic 0.8%