Read the docs

OpenIDC

Records23All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

OpenIDC records in CISA KEV

No OpenIDC vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mod Auth Openidc 15 records HIGH

Records

23 records

TI-2017-03971 CVE-2017-6062 · GHSA-5fhw-rc3x-vmxm

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)…

Priority MEDIUM 44

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" c…

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.03633 Published 2017-03-02 No fix listed CWE-287
TI-2021-12451 CVE-2021-32785

Format string bug in the Redis cache implementation

Priority LOW 38

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02731 Published 2021-07-22 Fixed in 2.4.9 CWE-134
TI-2021-12452 CVE-2021-32786

Open Redirect in oidc_validate_redirect_url()

Priority LOW 32

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02364 Published 2021-07-22 Partial fix · 2.4.9 CWE-601
TI-2020-16065 CVE-2020-26244 · GHSA-4fjv-pmhg-3rfg

Cryptographic issues in Python oic

Priority LOW 32

Python oic is a Python OpenID Connect implementation.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00832 Published 2020-12-02 Fixed in 1.2.1 CWE-325
TI-2021-16576 CVE-2021-39191

URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc

Priority LOW 31

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01735 Published 2021-09-03 Partial fix CWE-601
TI-2021-12458 CVE-2021-32792

XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

Priority LOW 30

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0151 Published 2021-07-26 Fixed in 2.4.9 CWE-79
TI-2019-16038 CVE-2019-1010247 · GHSA-xp9w-hvv3-f7rw

Cross-site scripting in ZmartZone IAM mod_auth_openidc

Priority LOW 30

ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01268 Published 2019-07-19 No fix listed CWE-79
TI-2019-11061 CVE-2019-14857 · GHSA-797h-qjwj-28jc

Open redirect in [UNKNOWN] mod_auth_openidc

Priority LOW 30

A flaw was found in mod_auth_openidc before version 2.4.0.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01598 Published 2019-11-26 Fixed CWE-601
TI-2022-07586 CVE-2022-23527

Open Redirect in oidc_validate_redirect_url()

Priority LOW 29

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00941 Published 2022-12-14 Partial fix · 2.4.12.2 CWE-601
TI-2026-39304 CVE-2026-54431 · GHSA-3pf6-g4x4-jm46

Improper Data Validation in liboauth2

Priority LOW 22

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material.

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00178 Published 2026-07-02 Fixed in 2.3.0 CWE-358
TI-2026-39303 CVE-2026-54430 · GHSA-qrcr-3862-9f4c

Server-Site Request Forgery in liboauth2

Priority LOW 22

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function.

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00169 Published 2026-07-02 Fixed in 2.3.0 CWE-918
Open these records in search →