Critical Security Update for libapache2-mod-auth-openidc: Addressing CVE-2025-31492
Summary
DSA-5904-1: libapache2-mod-auth-openidc - security update. Affects libapache2-mod-auth-openidc versions < 2.4.12.3-2+deb12u3. Fixed in 2.4.12.3-2+deb12u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libapache2-mod-auth-openidc is an Apache module that provides OpenID Connect authentication for web applications. It allows users to authenticate using their OpenID Connect providers, enhancing security and user experience. However, vulnerabilities in this module can expose web applications to unauthorized access and data breaches.
Vulnerability Detail
The vulnerability identified as CVE-2025-31492 affects libapache2-mod-auth-openidc, potentially allowing attackers to exploit weaknesses in the authentication process. This could lead to unauthorized access to sensitive resources, compromising the integrity and confidentiality of user data. The issue arises from improper handling of certain authentication flows, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
2.4.12.3-2+deb12u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache2-mod-auth-openidcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected authentication flows until the package is updated. This can be done by modifying the Apache configuration files to comment out or remove the relevant authentication directives.
Conclusion
The vulnerability CVE-2025-31492 in libapache2-mod-auth-openidc poses a significant risk to web applications relying on this module for authentication. Users are strongly advised to update to the latest patched version to mitigate potential security threats.
See every vulnerability recorded for libapache2-mod-auth-openidc →
FAQ
CVE-2025-31492 is a security vulnerability in the libapache2-mod-auth-openidc package that could allow unauthorized access to web applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to sensitive user data and compromise the security of web applications.
Yes, a patch is available in version 2.4.12.3-2+deb12u3 of the libapache2-mod-auth-openidc package.
If an immediate update is not possible, consider disabling the affected authentication flows as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libapache2-mod-auth-openidc.
