OpenIDC vulnerabilities
10 published CVEs name OpenIDC among the affected products.
- 10Published CVEs10 of them scored
- 5Last 12 monthspublished in the last year
- 1Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-53939
OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
OpenIDC · cjose
Critical9.1 - CVE-2026-53938
OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
OpenIDC · cjose
High8.2 - CVE-2026-54789
mod_auth_openidc has out-of-bounds read and write in state cookie parsing
OpenIDC · mod_auth_openidc
High7.5 - CVE-2026-54431
Improper Data Validation in liboauth2
OpenIDC · liboauth2
Medium5.1 - CVE-2026-54430
Server-Site Request Forgery in liboauth2
OpenIDC · liboauth2
Medium5.1 - CVE-2025-31492
mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data
OpenIDC · mod_auth_openidc
High8.2 - CVE-2024-24814
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
OpenIDC · mod_auth_openidc
High7.5 - CVE-2023-37464
Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose
OpenIDC · cjose
High8.6 - CVE-2023-28625
mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied
OpenIDC · mod_auth_openidc
High7.5 - CVE-2020-26244
Cryptographic issues in Python oic
OpenIDC · pyoidc
Medium6.8