CVE-2017-6059
HighSummary
Mod_auth_openidc in the Ping Identity OpenID Connect authentication module for Apache before version 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, triggering an invalid request.
Risk Assessment
Attackers can exploit this vulnerability to mislead users, potentially leading to loss of trust in the application and financial losses.
Recommendation
It is recommended to update the mod_auth_openidc module to version 2.14 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in mod_auth_openidc
See all- CVE-2017-6413High
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'AuthType oauth20' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
- CVE-2017-6062High
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'OIDCUnAuthAction pass' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
- CVE-2026-54789High
mod_auth_openidc before version 2.4.19.4 contains an out-of-bounds read and a one-byte out-of-bounds write in the state-cookie parser. The issue is fixed in version 2.4.19.4.
- CVE-2025-3891High
A flaw in the mod_auth_openidc module for Apache httpd allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Original NVD description (English source)
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.