sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2025-31492 mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

High 8.2 Published Updated

An attacker can access protected resources without authentication if the server uses POST for OIDC provider auth and lacks a gateway, leaking sensitive data.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2025-31492?

CVE-2025-31492 is a high-severity vulnerability in mod_auth_openidc, published on 6 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.

Weakness: CWE-200

Which versions are affected by CVE-2025-31492?

Linux distribution packages (40)
mod_auth_openidc AlmaLinux:10All versions2.4.15-4.el10_0.1
cjose AlmaLinux:8All versions0.6.1-4.module_el8.10.0+3881+234adf82
cjose AlmaLinux:8All versions0.6.1-4.module_el8.9.0+3631+0ced13d7
cjose-devel AlmaLinux:8All versions0.6.1-4.module_el8.10.0+3881+234adf82
cjose-devel AlmaLinux:8All versions0.6.1-4.module_el8.9.0+3631+0ced13d7
mod_auth_openidc AlmaLinux:8All versions2.4.9.4-7.module_el8.10.0+3978+e883c40d
mod_auth_openidc AlmaLinux:9All versions2.4.10-1.el9_6.1
mod_auth_openidc Red Hat:enterprise_linux:10.0All versions0:2.4.15-4.el10_0.1
mod_auth_openidc-debuginfo Red Hat:enterprise_linux:10.0All versions0:2.4.15-4.el10_0.1
mod_auth_openidc-debugsource Red Hat:enterprise_linux:10.0All versions0:2.4.15-4.el10_0.1
cjose Red Hat:enterprise_linux:8::appstreamAll versions0:0.6.1-4.module+el8.10.0+21813+b5444eb8
cjose-debuginfo Red Hat:enterprise_linux:8::appstreamAll versions0:0.6.1-4.module+el8.10.0+21813+b5444eb8
cjose-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:0.6.1-4.module+el8.10.0+21813+b5444eb8
cjose-devel Red Hat:enterprise_linux:8::appstreamAll versions0:0.6.1-4.module+el8.10.0+21813+b5444eb8
mod_auth_openidc Red Hat:enterprise_linux:8::appstreamAll versions0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066
mod_auth_openidc-debuginfo Red Hat:enterprise_linux:8::appstreamAll versions0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066
mod_auth_openidc-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066
mod_auth_openidc Red Hat:enterprise_linux:9::appstreamAll versions0:2.4.10-1.el9_6.1
mod_auth_openidc-debuginfo Red Hat:enterprise_linux:9::appstreamAll versions0:2.4.10-1.el9_6.1
mod_auth_openidc-debugsource Red Hat:enterprise_linux:9::appstreamAll versions0:2.4.10-1.el9_6.1
cjose Red Hat:rhel_aus:8.2::appstreamAll versions0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
cjose-debuginfo Red Hat:rhel_aus:8.2::appstreamAll versions0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
cjose-debugsource Red Hat:rhel_aus:8.2::appstreamAll versions0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
cjose-devel Red Hat:rhel_aus:8.2::appstreamAll versions0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
mod_auth_openidc Red Hat:rhel_aus:8.2::appstreamAll versions0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6
mod_auth_openidc-debuginfo Red Hat:rhel_aus:8.2::appstreamAll versions0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6
mod_auth_openidc-debugsource Red Hat:rhel_aus:8.2::appstreamAll versions0:2.4.9.4-1.module+el8.2.0+23039+41dcbbc6
cjose Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
cjose-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
cjose-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
cjose-devel Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
mod_auth_openidc Red Hat:rhel_aus:8.4::appstreamAll versions0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1
mod_auth_openidc-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1
mod_auth_openidc-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:2.4.9.4-1.module+el8.4.0+23043+b69acfab.1
cjose Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
cjose-debuginfo Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
cjose-debugsource Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
cjose-devel Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
mod_auth_openidc Red Hat:rhel_aus:8.6::appstreamAll versions0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1
mod_auth_openidc-debuginfo Red Hat:rhel_aus:8.6::appstreamAll versions0:2.4.9.4-1.module+el8.6.0+23040+515b7c43.1

How do I fix CVE-2025-31492?

Upgrade to a fixed version.

Is CVE-2025-31492 being exploited?

There is no known exploitation of CVE-2025-31492 in the wild and no public exploit code.

Sources

Also known as ALSA-2025:3997, ALSA-2025:7419, ALSA-2025:7490, AZL-59592, AZL-61786, CLSA-2025-1746188656 and 29 more.

Is CVE-2025-31492 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free