Back to Security Advisories

Mod_auth_openidc:2.3 Security Update — AlmaLinux 8 (ALSA-2026:92157)

ALSA-2026:92157 fixes CVE-2026-53939 in mod_auth_openidc on AlmaLinux 8 — the OpenID Connect authentication module for Apache. Rated Critical at CVSS 9.1 with a hard-coded-key class flaw (CWE-321), this sits in the module that decides who is logged in: update the module immediately with dnf update mod_auth_openidc and restart Apache.

Critical 9.1 CVSS
AlmaLinux 8

Affected Versions

2.3

What this means under a SharedLicense license

A hard-coded cryptographic key in an authentication module means an attacker who knows it can potentially forge the tokens the module trusts — bypassing login on every protected site without needing any user's credentials.

Type:

security

Severity:

critical

Release date:

2026-10-29

Description:

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

* cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 cjose-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm 049652da123d2f6376e2153aeaa6f265e2e9d539a2d7fce4defbe6c1ee206056
aarch64 mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.aarch64.rpm 4a9ad66e2b33de87388b82bfbeff6fe1a081a837f7247a45f4d401e0c4176897
aarch64 cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm 5e32fdf09a699760ba1b40ae3ef3e5e4ccf0c215cc6fbab514ad8d4d62a18e5d
ppc64le cjose-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm 94a39ffea423c154a72a55ade7810404048b862cac696b09015b9d29335c86bd
ppc64le cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm b0df76905a943b5408352d918ae156bc2e5341f221f6f5f82088b00c1b8cce3f
ppc64le mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.ppc64le.rpm d8838defefdd3acc857c073654aa7d4b6ad369ae8bec62d2097e640a3500b6af
s390x mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.s390x.rpm a90e743b4a90366deb01710f5b8e6114ca82531a62358d135fbb07b48e570d0e
s390x cjose-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm c004c10900891b4faba1726f38638ada2599d03449b55c1e92d26007f916892f
s390x cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm edc69e20cf4ef804d1ee038d288825bafec002c8559f8424f7536d0689e49d0c
x86_64 cjose-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm 21eea8f54bd22a4cca8e786f68a130047fc7e5bd21d41491c6de46dd71c69c09
x86_64 cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm 84f93b7a1dc5b63ce8be97d9994b929e6b3c903e16262d8ad98140a0125421b4
x86_64 mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.x86_64.rpm 8f4eb68e4f3f6575c178e13b26aa6a2471c6da2117468f4f95960a3101926214

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-53939?
It is a Critical vulnerability (CVSS 9.1, CWE-321 — use of hard-coded cryptographic key) in mod_auth_openidc, the OpenID Connect/OAuth 2.0 authentication module for Apache HTTP Server, fixed in the AlmaLinux 8 update ALSA-2026:92157.
Who is affected?
AlmaLinux 8 servers running Apache with mod_auth_openidc configured as an OpenID Connect Relying Party or OAuth 2.0 Resource Server — any SSO-protected site on this stack.
How do I apply the fix?
Run dnf update mod_auth_openidc and restart httpd. After updating, review your provider configuration and rotate any token-signing secrets as a precaution, since the flaw class involves key material.
Why is an authentication module flaw rated Critical?
Because the module is the login boundary itself — a hard-coded key flaw in token handling can let an attacker mint valid-looking sessions, turning every site behind the module into an open door.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System