# CVE-2025-31492: libapache2-mod-auth-openidc: mod_auth_openidc is an OpenID Certified authentication and authorizationmodule for the Apache 2.x HTTP server that im... CVE-2025-31492 is fixed in 7 products on 1 platform, first by libapache2-mod-auth-openidc 2.4.11-1ubuntu0.1, released April 6, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-31492 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.0059 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 6, 2025 ## Description mod_auth_openidc is an OpenID Certified authentication and authorizationmodule for the Apache 2.x HTTP server that implements the OpenID ConnectRelying Party functionality. Prior to 2.4.16.11, a bug in amod_auth_openidc results in disclosure of protected content tounauthenticated users. The conditions for disclosure are anOIDCProviderAuthRequestMethod POST, a valid account, and there mustn't beany application-level gateway (or load balancer etc) protecting the server.When you request a protected resource, the response includes the HTTPstatus, the HTTP headers, the intended response (the self-submitting form),and the protected resource (with no headers). This is an example of arequest for a protected resource, including all the data returned. In thecase where mod_auth_openidc returns a form, it has to return OK fromcheck_userid so as not to go down the error path in httpd. This means httpdwill try to issue the protected resource. oidc_content_handler is calledearly, which has the opportunity to prevent the normal output being issuedby httpd. oidc_content_handler has a number of checks for when itintervenes, but it doesn't check for this case, so the handler returnsDECLINED. Consequently, httpd appends the protected content to theresponse. The issue has been patched in mod_auth_openidc versions >=2.4.16.11. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | apache2-mod_auth_openidc opensuse-leap 15.6 | 2.4.17.1-150600.16.14.1 | [SUSE-SU-2025:4532-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4532-1.md) | Dec 29, 2025 | | Linux | apache2-mod_auth_openidc sles 15.6 | 2.4.17.1-150600.16.14.1 | [SUSE-SU-2025:4532-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4532-1.md) | Dec 29, 2025 | | Linux | apache2-mod_auth_openidc sles 15.7 | 2.4.17.1-150600.16.14.1 | [SUSE-SU-2025:4532-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4532-1.md) | Dec 29, 2025 | | Linux | cjose RHEL 8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | [RHSA-2025:3997](https://patchblox.com/security/data/fix/linux/rhsa-2025-3997.md) | Apr 23, 2025 | | Linux | cjose almalinux 8 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 | [ALSA-2025:3997](https://patchblox.com/security/data/fix/linux/alsa-2025-3997.md) | Apr 17, 2025 | | Linux | cjose ol 8 | 0:0.6.1-4.module+el8.10.0+90549+7b4eddfc | [ELSA-2025-3997](https://patchblox.com/security/data/fix/linux/elsa-2025-3997.md) | Apr 22, 2025 | | Linux | cjose rocky 8 | 0:0.6.1-4.module+el8.9.0+1384+4b58c166 | [RLSA-2025:3997](https://patchblox.com/security/data/fix/linux/rlsa-2025-3997.md) | Jul 29, 2025 | | Linux | cjose-devel RHEL 8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | [RHSA-2025:3997](https://patchblox.com/security/data/fix/linux/rhsa-2025-3997.md) | Apr 23, 2025 | | Linux | cjose-devel almalinux 8 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 | [ALSA-2025:3997](https://patchblox.com/security/data/fix/linux/alsa-2025-3997.md) | Apr 17, 2025 | | Linux | cjose-devel ol 8 | 0:0.6.1-4.module+el8.10.0+90549+7b4eddfc | [ELSA-2025-3997](https://patchblox.com/security/data/fix/linux/elsa-2025-3997.md) | Apr 22, 2025 | | Linux | libapache2-mod-auth-openidc Debian 11.6 (bullseye) | 2.4.9.4-0+deb11u5 | [DLA-4129-1](https://patchblox.com/security/data/fix/linux/dla-4129-1.md) | Apr 17, 2025 | | Linux | libapache2-mod-auth-openidc Debian 12.15 (bookworm) | 2.4.12.3-2+deb12u3 | [DSA-5904-1](https://patchblox.com/security/data/fix/linux/dsa-5904-1.md) | Apr 17, 2025 | | Linux | libapache2-mod-auth-openidc Debian 13.5 (trixie) | 2.4.16.11-1 | [DEBIAN-CVE-2025-31492](https://patchblox.com/security/data/fix/linux/debian-cve-2025-31492.md) | Apr 6, 2025 | | Linux | libapache2-mod-auth-openidc Debian 14 | 2.4.16.11-1 | [DEBIAN-CVE-2025-31492](https://patchblox.com/security/data/fix/linux/debian-cve-2025-31492.md) | Apr 6, 2025 | | Linux | libapache2-mod-auth-openidc Ubuntu 22.04.1 LTS (jammy) | 2.4.11-1ubuntu0.1 | [libapache2-mod-auth-openidc 2.4.11-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libapache2-mod-auth-openidc-2.4.11-1ubuntu0.1.md) | Apr 6, 2025 | | Linux | libapache2-mod-auth-openidc Ubuntu 24.04.5 LTS (noble) | 2.4.15.1-1ubuntu0.1 | [libapache2-mod-auth-openidc 2.4.15.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libapache2-mod-auth-openidc-2.4.15.1-1ubuntu0.1.md) | Apr 6, 2025 | | Linux | libapache2-mod-auth-openidc Ubuntu 24.10 (oracular) | 2.4.15.7-2ubuntu0.1 | [libapache2-mod-auth-openidc 2.4.15.7-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libapache2-mod-auth-openidc-2.4.15.7-2ubuntu0.1.md) | Jan 16, 2026 | | Linux | libapache2-mod-auth-openidc Ubuntu 25.04 (plucky) | 2.4.16.10-1ubuntu1 | [libapache2-mod-auth-openidc 2.4.16.10-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libapache2-mod-auth-openidc-2.4.16.10-1ubuntu1.md) | Jan 16, 2026 | | Linux | mod_auth_openidc RHEL 10 | 2.4.15-4.el10_0.1 | [RHSA-2025:7490](https://patchblox.com/security/data/fix/linux/rhsa-2025-7490.md) | Apr 6, 2025 | | Linux | mod_auth_openidc RHEL 8 | 0:2.4.9.4-7.module+el8.10.0+23023+ba6d7066 | [RHSA-2025:3997](https://patchblox.com/security/data/fix/linux/rhsa-2025-3997.md) | Apr 23, 2025 | | Linux | mod_auth_openidc RHEL 9 | 0:2.4.10-1.el9_6.1 | [RHSA-2025:7419](https://patchblox.com/security/data/fix/linux/rhsa-2025-7419.md) | May 13, 2025 | | Linux | mod_auth_openidc almalinux 10 | 2.4.15-4.el10_0.1 | [ALSA-2025:7490](https://patchblox.com/security/data/fix/linux/alsa-2025-7490.md) | May 13, 2025 | | Linux | mod_auth_openidc almalinux 8 | 2.4.9.4-7.module_el8.10.0+3978+e883c40d | [ALSA-2025:3997](https://patchblox.com/security/data/fix/linux/alsa-2025-3997.md) | Apr 17, 2025 | | Linux | mod_auth_openidc almalinux 9 | 2.4.10-1.el9_6.1 | [ALSA-2025:7419](https://patchblox.com/security/data/fix/linux/alsa-2025-7419.md) | May 13, 2025 | | Linux | mod_auth_openidc amzn 2023 | 2.4.16.11-1.amzn2023 | [ALAS2023-2025-1188](https://patchblox.com/security/data/fix/linux/alas2023-2025-1188.md) | Sep 10, 2025 | | Linux | mod_auth_openidc ol 10 | 0:2.4.15-4.el10_0.1 | [ELSA-2025-7490](https://patchblox.com/security/data/fix/linux/elsa-2025-7490.md) | Jun 27, 2025 | | Linux | mod_auth_openidc ol 8 | 0:2.4.9.4-7.module+el8.10.0+90549+7b4eddfc | [ELSA-2025-3997](https://patchblox.com/security/data/fix/linux/elsa-2025-3997.md) | Apr 22, 2025 | | Linux | mod_auth_openidc ol 9 | 0:2.4.10-1.el9_6.1 | [ELSA-2025-7419](https://patchblox.com/security/data/fix/linux/elsa-2025-7419.md) | May 21, 2025 | | Linux | mod_auth_openidc rocky 10 | 0:2.4.15-4.el10_0.1 | [RLSA-2025:7490](https://patchblox.com/security/data/fix/linux/rlsa-2025-7490.md) | Oct 3, 2025 | | Linux | mod_auth_openidc rocky 8 | 0:2.4.9.4-7.module+el8.10.0+1953+b76d6417 | [RLSA-2025:3997](https://patchblox.com/security/data/fix/linux/rlsa-2025-3997.md) | Jul 29, 2025 | | Linux | mod_auth_openidc rocky 9 | 0:2.4.10-1.el9_6.1 | [RLSA-2025:7419](https://patchblox.com/security/data/fix/linux/rlsa-2025-7419.md) | Oct 4, 2025 | | Linux | mod_auth_openidc-debuginfo amzn 2023 | 2.4.16.11-1.amzn2023 | [ALAS2023-2025-1188](https://patchblox.com/security/data/fix/linux/alas2023-2025-1188.md) | Sep 10, 2025 | | Linux | mod_auth_openidc-debugsource amzn 2023 | 2.4.16.11-1.amzn2023 | [ALAS2023-2025-1188](https://patchblox.com/security/data/fix/linux/alas2023-2025-1188.md) | Sep 10, 2025 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.