Mod_auth_openidc:2.3 Security Update — AlmaLinux 8 (ALSA-2026:92157)
ALSA-2026:92157 fixes CVE-2026-53939 in mod_auth_openidc on AlmaLinux 8 — the OpenID Connect authentication module for Apache. Rated Critical at CVSS 9.1 with a hard-coded-key class flaw (CWE-321), this sits in the module that decides who is logged in: update the module immediately with dnf update mod_auth_openidc and restart Apache.
Etkilenen Sürümler
2.3
SharedLicense lisansı altında bunun anlamı
A hard-coded cryptographic key in an authentication module means an attacker who knows it can potentially forge the tokens the module trusts — bypassing login on every protected site without needing any user's credentials.
Type:
security
Severity:
critical
Release date:
2026-10-29
Description:
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
* cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
| Architecture | Package | Checksum |
| aarch64 | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm | 049652da123d2f6376e2153aeaa6f265e2e9d539a2d7fce4defbe6c1ee206056 |
| aarch64 | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.aarch64.rpm | 4a9ad66e2b33de87388b82bfbeff6fe1a081a837f7247a45f4d401e0c4176897 |
| aarch64 | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm | 5e32fdf09a699760ba1b40ae3ef3e5e4ccf0c215cc6fbab514ad8d4d62a18e5d |
| ppc64le | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm | 94a39ffea423c154a72a55ade7810404048b862cac696b09015b9d29335c86bd |
| ppc64le | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm | b0df76905a943b5408352d918ae156bc2e5341f221f6f5f82088b00c1b8cce3f |
| ppc64le | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.ppc64le.rpm | d8838defefdd3acc857c073654aa7d4b6ad369ae8bec62d2097e640a3500b6af |
| s390x | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.s390x.rpm | a90e743b4a90366deb01710f5b8e6114ca82531a62358d135fbb07b48e570d0e |
| s390x | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm | c004c10900891b4faba1726f38638ada2599d03449b55c1e92d26007f916892f |
| s390x | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm | edc69e20cf4ef804d1ee038d288825bafec002c8559f8424f7536d0689e49d0c |
| x86_64 | cjose-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm | 21eea8f54bd22a4cca8e786f68a130047fc7e5bd21d41491c6de46dd71c69c09 |
| x86_64 | cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm | 84f93b7a1dc5b63ce8be97d9994b929e6b3c903e16262d8ad98140a0125421b4 |
| x86_64 | mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.x86_64.rpm | 8f4eb68e4f3f6575c178e13b26aa6a2471c6da2117468f4f95960a3101926214 |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
Sıkça Sorulan Sorular
What is CVE-2026-53939?
Who is affected?
How do I apply the fix?
Why is an authentication module flaw rated Critical?
Referanslar
Sisteminizi güvenlik açıkları açısından kontrol edin
Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.
Sisteminizi Kontrol Edin