CVE-2025-3891
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
A flaw in the mod_auth_openidc module for Apache httpd allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Risk Assessment
The risk is that an attacker can easily disrupt the HTTP server, causing unavailability of web applications for users, potentially leading to financial losses and reputational damage.
Recommendation
It is recommended to immediately update mod_auth_openidc to the latest patched version and temporarily disable the OIDCPreservePost directive if not essential.
Other vulnerabilities in mod_auth_openidc
See all- CVE-2017-6059High
Mod_auth_openidc in the Ping Identity OpenID Connect authentication module for Apache before version 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, triggering an invalid request.
- CVE-2017-6413High
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'AuthType oauth20' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
- CVE-2017-6062High
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'OIDCUnAuthAction pass' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
- CVE-2026-54789High
mod_auth_openidc before version 2.4.19.4 contains an out-of-bounds read and a one-byte out-of-bounds write in the state-cookie parser. The issue is fixed in version 2.4.19.4.
Original NVD description (English source)
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.