CVE-2025-31492: 
Alma Linux vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-31492) was discovered in modauthopenidc, an OpenID Certified authentication and authorization module for Apache 2.x HTTP server. The vulnerability was disclosed on April 6, 2025, affecting versions prior to 2.4.16.11. This security flaw allows unauthorized users to access protected content under specific conditions, particularly when using the POST authentication request method (GitHub Advisory, NVD).

The vulnerability occurs when specific conditions are met: the OIDCProviderAuthRequestMethod is set to POST, a valid account exists, and there is no application-level gateway or load balancer protecting the server. When exploited, the response to a protected resource request includes not only the HTTP status and headers but also leaks the protected content along with the self-submitting form. This happens because when modauthopenidc returns a form, it must return OK from checkuserid to avoid the error path in httpd, causing httpd to append the protected content to the response. The vulnerability has been assigned a CVSS v4.0 base score of 8.2 (High) with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N ([GitHub Advisory](https://github.com/OpenIDC/modauth_openidc/security/advisories/GHSA-59jp-rwph-878r)).

The vulnerability leads to the disclosure of protected content to unauthenticated users, potentially exposing sensitive information. The impact is particularly severe as it bypasses authentication mechanisms and allows unauthorized access to protected resources. The high CVSS score reflects the significant confidentiality impact of this vulnerability (GitHub Advisory).

The vulnerability has been patched in modauthopenidc version 2.4.16.11 and later. For systems that cannot immediately update, two workarounds are available: 1) Switch to OIDCProviderAuthRequestMethod GET (the default setting), or 2) Implement an application-level gateway to protect the server. Various distributions have also released security updates, such as Debian 11 (Bullseye) fixing the issue in version 2.4.9.4-0+deb11u5 (Debian Advisory, GitHub Advisory).