Skip to content
OpenAdvisories
Critical RLSA-2026:92157 1 CVE

Critical: mod_auth_openidc:2.3 security update

Published Oct 30, 2026 · Updated Oct 30, 2026

Ecosystem: Rocky Linux

Summary

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

* cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 mod_auth_openidc 0:2.4.9.4-9.module+el8.10.0+40373+8a3f15d2

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-53939

    OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512…

    OpenIDC cjose cjose cjose Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2530243
  • advisory
    https://access.redhat.com/errata/RHSA-2026:92157