mod_auth_openidc (AlmaLinux:8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package mod_auth_openidc, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (10)

• CVE-2023-37464 — CVSS 8.6 (high): OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly…
• CVE-2025-31492: mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID…
• CVE-2025-3891 — CVSS 7.5 (high): A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial…
• CVE-2023-28625 — CVSS 7.5 (high): mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying…
• CVE-2024-24814 — CVSS 7.5 (high): mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the…
• CVE-2021-32791 — CVSS 5.9 (medium): mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying…
• CVE-2021-32786 — CVSS 4.7 (medium): mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying…
• CVE-2021-39191 — CVSS 4.7 (medium): mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying…
• CVE-2022-23527 — CVSS 4.7 (medium): mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to…
• CVE-2021-32792 — CVSS 3.1 (low): mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying…