CVE-2017-6413
HighSummary
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'AuthType oauth20' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
Risk Assessment
Attackers can gain access to protected resources without proper authorization, posing a serious threat to data security within the organization.
Recommendation
It is recommended to update the mod_auth_openidc module to version 2.1.6 or later to mitigate this vulnerability.
Other vulnerabilities in mod_auth_openidc
See all- CVE-2017-6059High
Mod_auth_openidc in the Ping Identity OpenID Connect authentication module for Apache before version 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, triggering an invalid request.
- CVE-2017-6062High
The 'OpenID Connect Relying Party and OAuth 2.0 Resource Server' (mod_auth_openidc) module before version 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an 'OIDCUnAuthAction pass' configuration, allowing remote attackers to bypass authentication via crafted HTTP traffic.
- CVE-2026-54789High
mod_auth_openidc before version 2.4.19.4 contains an out-of-bounds read and a one-byte out-of-bounds write in the state-cookie parser. The issue is fixed in version 2.4.19.4.
- CVE-2025-3891High
A flaw in the mod_auth_openidc module for Apache httpd allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Original NVD description (English source)
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.