Mod_auth_openidc:2.3 Security Update — AlmaLinux 8 (ALSA-2026:92157)
ALSA-2026:92157 fixes CVE-2026-53939 in mod_auth_openidc on AlmaLinux 8 — the OpenID Connect authentication module for Apache. Rated Critical at CVSS 9.1 with a hard-coded-key class flaw (CWE-321), this sits in the module that decides who is logged in: update the module immediately with dnf update mod_auth_openidc and restart Apache.
Betroffene Versionen
2.3
Was das unter einer SharedLicense-Lizenz bedeutet
A hard-coded cryptographic key in an authentication module means an attacker who knows it can potentially forge the tokens the module trusts — bypassing login on every protected site without needing any user's credentials.
Type:
security
Severity:
critical
Release date:
2026-10-29
Description:
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
* cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
| Architecture | Package | Checksum |
| aarch64 | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm | 049652da123d2f6376e2153aeaa6f265e2e9d539a2d7fce4defbe6c1ee206056 |
| aarch64 | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.aarch64.rpm | 4a9ad66e2b33de87388b82bfbeff6fe1a081a837f7247a45f4d401e0c4176897 |
| aarch64 | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm | 5e32fdf09a699760ba1b40ae3ef3e5e4ccf0c215cc6fbab514ad8d4d62a18e5d |
| ppc64le | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm | 94a39ffea423c154a72a55ade7810404048b862cac696b09015b9d29335c86bd |
| ppc64le | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm | b0df76905a943b5408352d918ae156bc2e5341f221f6f5f82088b00c1b8cce3f |
| ppc64le | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.ppc64le.rpm | d8838defefdd3acc857c073654aa7d4b6ad369ae8bec62d2097e640a3500b6af |
| s390x | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.s390x.rpm | a90e743b4a90366deb01710f5b8e6114ca82531a62358d135fbb07b48e570d0e |
| s390x | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm | c004c10900891b4faba1726f38638ada2599d03449b55c1e92d26007f916892f |
| s390x | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm | edc69e20cf4ef804d1ee038d288825bafec002c8559f8424f7536d0689e49d0c |
| x86_64 | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm | 21eea8f54bd22a4cca8e786f68a130047fc7e5bd21d41491c6de46dd71c69c09 |
| x86_64 | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm | 84f93b7a1dc5b63ce8be97d9994b929e6b3c903e16262d8ad98140a0125421b4 |
| x86_64 | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.x86_64.rpm | 8f4eb68e4f3f6575c178e13b26aa6a2471c6da2117468f4f95960a3101926214 |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
Häufig gestellte Fragen
What is CVE-2026-53939?
Who is affected?
How do I apply the fix?
Why is an authentication module flaw rated Critical?
Referenzen
System auf Schwachstellen prüfen
Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.
System prüfen