Improper access control in mod_auth_openidc - #VU139915
Published: July 28, 2026
Vulnerability identifier: #VU139915
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: ZmartZone IAM
Affected software:
mod_auth_openidc
mod_auth_openidc
Detailed vulnerability description
The vulnerability allows a remote user to bypass access restrictions.
The vulnerability exists due to improper access control in local JWT access token validation in OAuth 2.0 Resource Server mode when processing bearer tokens under a Require valid-user authorization policy. A remote user can present a validly signed JWT access token issued for a different audience to bypass access restrictions.
The issue is limited to deprecated Resource Server deployments using local JWT validation without introspection, and has practical consequence where verification key material is shared across multiple audiences.
Remediation
Install security update from vendor's website.