CVE-2026-54789: mod_auth_openidc Buffer Overflow Vulnerability

CVE-2026-54789 Overview

CVE-2026-54789 is an out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of mod_auth_openidc, the OpenID Certified authentication and authorization module for the Apache 2.x HTTP server. The flaw affects versions prior to 2.4.19.4. A state-prefixed Cookie token that lacks an = character causes the parser to scan past the end of the token buffer, resulting in memory corruption. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. The weakness is classified as [CWE-125] Out-of-bounds Read.

Critical Impact
A remote, unauthenticated attacker can send a malformed Cookie header to trigger a denial-of-service condition against Apache HTTP servers running vulnerable versions of mod_auth_openidc.

Affected Products

OpenIDC mod_auth_openidc versions prior to 2.4.19.4
Apache 2.x HTTP servers deploying the vulnerable module for OpenID Connect Relying Party functionality
Reverse proxies and web applications relying on mod_auth_openidc for authentication

Discovery Timeline

2026-08-21 - CVE-2026-54789 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-54789

Vulnerability Analysis

The vulnerability resides in the state-cookie parsing logic within src/state.c. When mod_auth_openidc processes an inbound Cookie header, it iterates through cookie tokens searching for the = delimiter that separates a cookie name from its value. The pre-patch loop condition only checked that the pointer was non-NULL and that the current character was not =. Since the pointer is only incremented and never reassigned to NULL, the loop had no terminating condition when a state-prefixed token lacked an =. The parser then read past the end of the token buffer and eventually wrote a NUL byte one position beyond the allocated memory region.

Root Cause

The defect is a classic missing string-terminator check. The loop while (cookie != NULL && *cookie != OIDC_CHAR_EQUAL) fails to test for '\0', so a well-formed token without = produces an unbounded scan. This satisfies the definition of [CWE-125] and additionally causes a one-byte out-of-bounds write when the parser subsequently NUL-terminates the scanned name.

Attack Vector

The attack vector is remote and unauthenticated. An attacker sends an HTTP request with a crafted Cookie header containing a state-prefixed token that omits the = separator. No user interaction or privileges are required. Successful exploitation produces memory corruption in the Apache worker process, leading to process crashes and service disruption.

// Patch excerpt from src/state.c
// Source: https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be652a73a8630

		return 0;

	char *cookieName = cookie;
-	while (cookie != NULL && *cookie != OIDC_CHAR_EQUAL)
+	/* stop at the string terminator as well as at '='; the previous "cookie != NULL" condition could
+	 * never be false (cookie is only incremented) so a state-prefixed token without a '=' would scan
+	 * past the end of the buffer (out-of-bounds read, and a subsequent out-of-bounds NUL write) */
+	while ((*cookie != '\0') && (*cookie != OIDC_CHAR_EQUAL))
 		cookie++;
 	if (*cookie != OIDC_CHAR_EQUAL)
 		return 0;

Source: OpenIDC mod_auth_openidc commit 8017478

Detection Methods for CVE-2026-54789

Indicators of Compromise

Apache worker process crashes or segmentation faults correlated with inbound requests containing state-prefixed cookies
HTTP requests carrying Cookie headers with tokens that omit the = separator (for example, mod_auth_openidc_state_<value> with no assignment)
Repeated 5xx responses or connection resets from endpoints protected by mod_auth_openidc

Detection Strategies

Inspect Apache error_log and system core-dump directories for crashes originating in mod_auth_openidc.so
Deploy WAF or reverse-proxy rules that flag malformed Cookie headers where tokens lack = delimiters
Correlate authentication endpoint failures with elevated worker restarts in process monitoring telemetry

Monitoring Recommendations

Track the installed version of mod_auth_openidc across Apache fleets and alert when versions below 2.4.19.4 are detected
Monitor request rates against OIDC callback URLs for anomalous spikes with malformed cookie payloads
Baseline Apache worker crash frequency and alert on deviations that coincide with authentication traffic

How to Mitigate CVE-2026-54789

Immediate Actions Required

Upgrade mod_auth_openidc to version 2.4.19.4 or later on all Apache HTTP servers
Inventory all Apache instances relying on OpenID Connect authentication and prioritize internet-facing hosts
Restart Apache worker processes after upgrading to ensure the patched module is loaded

Patch Information

The fix is available in mod_auth_openidc version 2.4.19.4. The corrective change modifies the state-cookie parser loop in src/state.c to terminate on both '\0' and =, rejecting value-less tokens before they cause memory corruption. Details are published in the GitHub Security Advisory GHSA-vgr5-qcpp-x2pr and the upstream commit.

Workarounds

Place an upstream reverse proxy or WAF that rejects or normalizes malformed Cookie headers, specifically tokens lacking =
No in-product workarounds exist; upstream filtering is a stop-gap only and upgrading remains the recommended remediation
Restrict exposure of the OIDC redirect URI to trusted networks where feasible until patching is complete

bash

# Example ModSecurity rule to block Cookie tokens without '=' targeting mod_auth_openidc state cookies
SecRule REQUEST_HEADERS:Cookie "@rx (?:^|;\s*)mod_auth_openidc_state[^=;]*(?:;|$)" \
    "id:1054789,phase:1,deny,status:400,log,\
    msg:'CVE-2026-54789: malformed mod_auth_openidc state cookie (missing =)'"