PT-2017-4171 · Apache+5 · Mod Auth Openidc+5
Published
2017-01-30
·
Updated
2025-12-29
·
CVE-2021-32786
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
mod auth openidc versions prior to 2.4.9
Description
The issue is related to the
oidc validate redirect url() function in mod auth openidc, which does not parse URLs the same way as most browsers do. This leads to an Open Redirect vulnerability in the logout functionality, allowing a remote attacker to access and compromise confidential data. The vulnerability can be mitigated by configuring mod auth openidc to only allow redirection whose destination matches a given regular expression.Recommendations
For versions prior to 2.4.9, update to version 2.4.9 or later, where the bug has been fixed by replacing any backslash of the URL to redirect with slashes.
As a temporary workaround, consider configuring
mod auth openidc to only allow redirection whose destination matches a given regular expression.Exploit
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Mod Auth Openidc