CVE-2026-54789

Name of the Vulnerable Software and Affected Versions mod auth openidc (affected versions not specified)

Description An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod auth openidc. The function oidc state cookies parse token() in src/state.c scans a cookie token for the = character that separates the name from the value. Because the loop does not stop at the string terminator and the cookie != NULL test never becomes false, a request containing a Cookie header that starts with the configured state-cookie prefix (default mod auth openidc state ) but lacks an = character causes the loop to read adjacent process memory. Once a = byte is encountered, a NUL byte is written to that out-of-bounds location. This issue is reachable by an unauthenticated remote client via requests that initiate a new authentication flow or requests to the OIDCRedirectURI callback.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.