OpenIDC vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20232
3. 20241
4. 20251
5. 20265

Newest CVEs

• CVE-2026-53939

  OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

  OpenIDC · cjose

  Critical9.1
• CVE-2026-53938

  OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)

  OpenIDC · cjose

  High8.2
• CVE-2026-54789

  mod_auth_openidc has out-of-bounds read and write in state cookie parsing

  OpenIDC · mod_auth_openidc

  High7.5
• CVE-2026-54431

  Improper Data Validation in liboauth2

  OpenIDC · liboauth2

  Medium5.1
• CVE-2026-54430

  Server-Site Request Forgery in liboauth2

  OpenIDC · liboauth2

  Medium5.1
• CVE-2025-31492

  mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

  OpenIDC · mod_auth_openidc

  High8.2
• CVE-2024-24814

  Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc

  OpenIDC · mod_auth_openidc

  High7.5
• CVE-2023-37464

  Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

  OpenIDC · cjose

  High8.6
• CVE-2023-28625

  mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied

  OpenIDC · mod_auth_openidc

  High7.5
• CVE-2020-26244

  Cryptographic issues in Python oic

  OpenIDC · pyoidc

  Medium6.8