en
OpenIDC is a multinational organization offering OpenID Connect and OAuth 2.0 access management and commercial support for open source components like mod_auth_openidc and liboauth2. It operates globally with enterprise customers and a focus on modern IAM.
Severity across 10 analyzed records
As of 09/11/2026, OpenIDC recorded 5 security vulnerabilities in the last 90 days across 3 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, cjose had the most security vulnerabilities in the OpenIDC ecosystem, with 2 vulnerabilities—approximately 40% of the provider's total vulnerabilities during this period.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-53939OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption | Exploitation statusPublic exploit | FixYes | Affected productcjose | Published09/08/2026 | SeverityCritical |
CVE-2026-53938OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) | Exploitation statusNot known exploited | FixNot confirmed | Affected productcjose | Published09/08/2026 | SeverityHigh |
CVE-2026-54789mod_auth_openidc has out-of-bounds read and write in state cookie parsing | Exploitation statusNot known exploited | FixYes | Affected productmod_auth_openidc | Published08/21/2026 | SeverityHigh |
CVE-2026-54431Improper Data Validation in liboauth2 | Exploitation statusNot known exploited | FixYes | Affected productliboauth2 | Published07/02/2026 | SeverityMedium |
CVE-2026-54430Server-Site Request Forgery in liboauth2 | Exploitation statusNot known exploited | FixYes | Affected productliboauth2 | Published07/02/2026 | SeverityMedium |
CVE-2025-31492mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data | Exploitation statusNot known exploited | FixYes | Affected productmod_auth_openidc | Published04/06/2025 | SeverityHigh |
CVE-2024-24814Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc | Exploitation statusPublic exploit | FixNot confirmed | Affected productmod_auth_openidc | Published02/13/2024 | SeverityHigh |
CVE-2023-37464Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose | Exploitation statusNot known exploited | FixNot confirmed | Affected productcjose | Published07/14/2023 | SeverityHigh |
CVE-2023-28625mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied | Exploitation statusNot known exploited | FixNot confirmed | Affected productmod_auth_openidc | Published04/03/2023 | SeverityHigh |
CVE-2022-23527Open Redirect in oidc_validate_redirect_url() | Exploitation statusNot known exploited | FixYes | Affected productmod_auth_openidc | Published12/14/2022 | SeverityMedium |
CVE-2021-39191URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc | Exploitation statusNot confirmed | FixNot confirmed | Affected productmod_auth_openidc | Published09/03/2021 | SeverityMedium |
CVE-2021-32792XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc | Exploitation statusNot confirmed | FixNot confirmed | Affected productmod_auth_openidc | Published07/26/2021 | SeverityLow |
CVE-2021-32791Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc | Exploitation statusNot confirmed | FixNot confirmed | Affected productmod_auth_openidc | Published07/26/2021 | SeverityMedium |
CVE-2021-32785Format string bug in the Redis cache implementation | Exploitation statusNot confirmed | FixNot confirmed | Affected productmod_auth_openidc | Published07/22/2021 | SeverityMedium |
CVE-2021-32786Open Redirect in oidc_validate_redirect_url() | Exploitation statusNot confirmed | FixYes | Affected productmod_auth_openidc | Published07/22/2021 | SeverityMedium |
CVE-2021-20718CVE-2021-20718 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmod_auth_openidc | Published05/20/2021 | SeverityUnknown |
CVE-2020-26244Cryptographic issues in Python oic | Exploitation statusNot confirmed | FixYes | Affected productpyoidc | Published12/02/2020 | SeverityMedium |
CVE-2019-20479CVE-2019-20479 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/20/2020 | SeverityUnknown |
CVE-2019-14857CVE-2019-14857 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmod_auth_openidc | Published11/26/2019 | SeverityMedium |
CVE-2019-1010247CVE-2019-1010247 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmod_auth_openidc | Published07/19/2019 | SeverityUnknown |
CVE-2017-6059CVE-2017-6059 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/12/2017 | SeverityUnknown |
CVE-2017-6062CVE-2017-6062 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/02/2017 | SeverityUnknown |
CVE-2017-6413CVE-2017-6413 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/02/2017 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
