CVE-2017-6062
HighSummary
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'OIDCUnAuthAction pass' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
Risk Assessment
Attackers can exploit this vulnerability to gain access to protected resources without authorization, potentially leading to unauthorized access to sensitive data.
Recommendation
It is recommended to update the module to version 2.1.5 or later to mitigate the risk of authentication bypass.
Other vulnerabilities in mod_auth_openidc
See all- CVE-2017-6059High
Mod_auth_openidc in the Ping Identity OpenID Connect authentication module for Apache before version 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, triggering an invalid request.
- CVE-2017-6413High
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'AuthType oauth20' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
- CVE-2026-54789High
mod_auth_openidc before version 2.4.19.4 contains an out-of-bounds read and a one-byte out-of-bounds write in the state-cookie parser. The issue is fixed in version 2.4.19.4.
- CVE-2025-3891High
A flaw in the mod_auth_openidc module for Apache httpd allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Original NVD description (English source)
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.