SB2026110646 - Multiple vulnerabilities in mod_auth_openidc

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to bypass authentication and read or overwrite files in protected locations.

The vulnerability exists due to mod_auth_openidc reusing identities without authenticating the target when Apache sub-requests or internal redirects cross from locations configured with OIDCUnAuthAction pass or weaker authentication into separately protected locations. An unauthenticated remote attacker can trigger DirectoryIndex resolution or a WebDAV COPY to read protected content or overwrite protected files.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged remote attacker to access a higher-trust resource server using a lower-trust server’s valid token.

The vulnerability exists due to mod_auth_openidc caching validation results without binding them to verifiers in non-default OAuth resource-server deployments where differently trusted virtual hosts share a cache and OIDCCryptoPassphrase. A low-privileged remote attacker can submit the token to the lower-trust host, then replay it against the target to bypass validation, provided local JWT issuer/audience checks do not exclude it.

3) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the Apache host as the worker user.

The vulnerability exists due to mod_auth_openidc interpreting an exec: prefix in provider-supplied secrets as a command when processing metadata. An unauthenticated remote attacker can trigger registration with a malicious identity provider when multi-provider OIDCMetadataDir and Dynamic Client Registration are enabled without OIDCDiscoverIssuersAllowed, causing a supplied client_secret to execute.

Remediation

Install update from vendor's website.

References

• https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-98m5-m556-8684
• https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-gwg9-pmp9-m6wv
• https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-j3g4-73w8-p842