# CVE-2025-31492 - mod\_auth\_openidc

**URL:** <https://discourse.openondemand.org/t/cve-2025-31492-mod-auth-openidc/4219>\
**Category:** Get Help\
**Created:** [April 24, 2025, 8:35pm UTC](https://discourse.openondemand.org/t/cve-2025-31492-mod-auth-openidc/4219 "2025-04-24T20:35:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [April 24, 2025, 8:35pm UTC](https://discourse.openondemand.org/t/cve-2025-31492-mod-auth-openidc/4219/1 "2025-04-24T20:35:56Z")

</div>

Our security team alerted me to a recently announced vulnerability in mod\_auth\_openidc:

- [OIDCProviderAuthRequestMethod POST leaks protected data · Advisory · OpenIDC/mod\_auth\_openidc · GitHub](https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r)
- [https://access.redhat.com/errata/RHSA-2025:4128](https://access.redhat.com/errata/RHSA-2025:4128)

We have some RHEL 8 systems running OOD. While Red Hat has released updated packages to fix this issue, I see a higher version of mod\_auth\_openidc hosted in the OOD repo which was last updated in 2023. Could you tell me:

- if you are planning on backporting this fix?
- or, is there some significant difference in functionality that would prevent me from blacklisting the package in OOD repo (2.4.14.1) and using the latest RHEL 8 release (2.4.9.4)?

Thanks,  
Yan

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 25, 2025, 2:40pm UTC](https://discourse.openondemand.org/t/cve-2025-31492-mod-auth-openidc/4219/2 "2025-04-25T14:40:20Z")

</div>

We’re not planning to backport this fix and yes you can likely exclude this package from your yum repos.

Indeed - I don’t see we distribute this anymore. It appears on our 2.0 repos, but it’s not on our 3.0 and beyond versions. So upgrading is also a OnDemand is also a way to get rid of this package as it’s only on the 2.0 repositories and below.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [October 22, 2025, 2:40pm UTC](https://discourse.openondemand.org/t/cve-2025-31492-mod-auth-openidc/4219/3 "2025-10-22T14:40:35Z")

</div>

Closed on October 22, 2025, 2:40pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.