TI-2021-12452 Aliases CVE-2021-32786

Open Redirect in oidc_validate_redirect_url()

LOW 32CWE-601Published 2021-07-22 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-601.

Summary

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.

Why it matters now

EPSS 0.02364 83rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial mod_auth_openidc (zmartzone): 2.4.9Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIDC	mod_auth_openidc	before 2.4.9	2.4.9	Patch available	CNA

mod_auth_openidc VendorOpenIDC Affected before 2.4.9 Fixed in 2.4.9 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:openidc:mod_auth_openidc::::::::	before 2.4.9	Vulnerable	OpenIDC
cpe:2.3:a:apache:http_server::::::::	2.0.0 – 2.4.48	Running on	Apache
cpe:2.3:o:fedoraproject:fedora:33:::::::*	33	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject

cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:* Versions before 2.4.9 Vulnerable ·OpenIDC
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.4.48 Running on ·Apache
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

Fix · CNA mod_auth_openidc (zmartzone) Fixed in 2.4.9

Red Hat 1 advisory

RHSA-2022:1823 Released 2022-05-10 · Red Hat rating Moderate
mod_auth_openidc:2.3 security update
- Red Hat Enterprise Linux AppStream (v. 8) cjose-0.6.1-2.module+el8+2454+f890a43a.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-2.module+el8+2454+f890a43a.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-2.module+el8+2454+f890a43a.s390x::mod_auth_openidc:2.3 +11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2021-07-22
zmartzone mod_auth_openidc — FEDORA-2021-e3017c538a
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-12458 XSS vulnerability when using OIDCPreservePost On in mod_auth_openidcPriority LOW 30
- TI-2021-12457 Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidcPriority LOW 29
Show all 3 records → Advisory →
Advisory · 2021-07-22
zmartzone mod_auth_openidc — FEDORA-2021-17f5cedf66
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-12458 XSS vulnerability when using OIDCPreservePost On in mod_auth_openidcPriority LOW 30
- TI-2021-12457 Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidcPriority LOW 29
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2022:1823

Not affected: 1 product

Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2021-32786

References

Exploit 1

https://daniel.haxx.se/blog/2017/01/30/one-url-standard-please/

Patch 2

Advisory 5

Other 1

[debian-lts-announce] 20230430 [SECURITY] [DLA 3409-1] libapache2-mod-auth-openidc security update

TI-2024-16331 Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc CVSS 3.1HIGH 7.5
TI-2017-04220 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
TI-2017-03971 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
TI-2023-13144 mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied CVSS 3.1HIGH 7.5
TI-2017-03968 Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache… CVSS 3.1HIGH 7.5
TI-2021-03944 Uncontrolled resource consumption in OpenIDC mod_auth_openidc CVSS 3.1HIGH 7.5

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences