Red Hat mod_auth_openidc Updates Protect Extended-Support RHEL
Tech GuruQuick Answer
Red Hat has fixed CVE-2026-54789 in mod_auth_openidc, the Apache OpenID Connect/OAuth module. Malformed state-cookie parsing can deny service without authentication. Choose the update for the installed RHEL support stream; the RHEL 8 module name remains mod_auth_openidc:2.3 even though its packaged software version is 2.4.9.4.
Confirm Scope And Apply The Supported Fix
What to do now: Identify Apache hosts that load mod_auth_openidc, record their module/repository and package release, and update the matching branch before validating the identity-provider flow.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Supported RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4, and RHEL 10.0 EUS mod_auth_openidc packages |
|---|---|
| Advisory | RHSA-2026:69712 / RHSA-2026:69713 / RHSA-2026:69719 / RHSA-2026:69715 / RHSA-2026:69717 / RHSA-2026:69720 / RHSA-2026:69718 |
| CVE | CVE-2026-54789 |
| Authoritative release date | RHSA-2026:69712: 2026-09-22T01:04:03+00:00 (CSAF initial release) RHSA-2026:69713: 2026-09-22T01:04:36+00:00 (CSAF initial release) RHSA-2026:69719: 2026-09-22T02:06:07+00:00 (CSAF initial release) RHSA-2026:69715: 2026-09-22T02:06:26+00:00 (CSAF initial release) RHSA-2026:69717: 2026-09-22T02:07:12+00:00 (CSAF initial release) RHSA-2026:69720: 2026-09-22T02:07:42+00:00 (CSAF initial release) RHSA-2026:69718: 2026-09-22T02:07:45+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69712: 2026-09-22T01:04:03+00:00 (CSAF revision history) RHSA-2026:69713: 2026-09-22T01:04:36+00:00 (CSAF revision history) RHSA-2026:69719: 2026-09-22T02:06:07+00:00 (CSAF revision history) RHSA-2026:69715: 2026-09-22T02:06:26+00:00 (CSAF revision history) RHSA-2026:69717: 2026-09-22T02:07:12+00:00 (CSAF revision history) RHSA-2026:69720: 2026-09-22T02:07:42+00:00 (CSAF revision history) RHSA-2026:69718: 2026-09-22T02:07:45+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled Supported RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4, and RHEL 10.0 EUS mod_auth_openidc packages builds before the branch-specific fixed package listed by Red Hat. |
| Fixed version | mod_auth_openidc package builds (epoch 0): RHEL 7 ELS: 1.8.8-9.el7_9.2RHEL 8.4 module: 2.4.9.4-1.module+el8.4.0+24868+593d10ef.3RHEL 8.6 module: 2.4.9.4-1.module+el8.6.0+24867+df0294a5.3RHEL 8.8 module: 2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3RHEL 9.2 SAP: 2.4.9.4-1.el9_2.4RHEL 9.4 SAP: 2.4.9.4-4.el9_4.3RHEL 10.0 EUS: 2.4.15-4.el10_0.2. Use the matching entitled repository and architecture. |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The checked mod_auth_openidc advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The seven advisories cover separate RHEL 7, 8, 9 and 10 support streams. Their common CVE and upstream version do not make their RPMs interchangeable. Red Hat rates the issue Important; the published CVSS score is 7.5 with availability impact.
What To Validate Now
- Inventory. Locate Supported RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4, and RHEL 10.0 EUS mod_auth_openidc packages deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled Supported RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4, and RHEL 10.0 EUS mod_auth_openidc packages builds before the branch-specific fixed package listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. Install the complete RPM/module update for the applicable row; do not change a RHEL 8 module stream merely because its software version differs from the stream label.
- Validate. Confirm the installed and loaded module update, then test sign-in, callback handling, session renewal and protected-resource access against the configured identity provider. Check Apache errors and availability after rollout.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Red Hat describes filtering malformed OIDC state-cookie tokens before mod_auth_openidc processes them as an interim measure. Validate any WAF, proxy or Apache rule against legitimate authentication traffic; filtering is not evidence that the vulnerable module has been patched. Plan the module reload and rollback with the authentication service owner.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- RHSA-2026:69712
- RHSA-2026:69713
- RHSA-2026:69719
- RHSA-2026:69715
- RHSA-2026:69717
- RHSA-2026:69720
- RHSA-2026:69718
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
