CVE-2017-6413
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module...
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
CVE-2017-6413- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
CVE-2017-6413- Updated
- 2026-11-02
EUVDEUVD-2017-15470 No score
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
EUVD-2017-15470- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9r74-cmm5-qv85
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module...
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
GHSA-9r74-cmm5-qv85- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
CVE-2017-6413- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6413
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
DEBIAN-CVE-2017-6413- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2019:2112
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2019:2112- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6413
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
UBUNTU-CVE-2017-6413- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-openidcDebian:12 |
before 2.1.6-1 | 2.1.6-1 |
libapache2-mod-auth-openidcDebian:13 |
before 2.1.6-1 | 2.1.6-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.1.6-1 | 2.1.6-1 |
mod_auth_openidcRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
mod_auth_openidcRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
libapache2-mod-auth-openidcUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.8.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6413 is a high vulnerability (CVSS 8.6) in Openidc Mod Auth Openidc, published March 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.25%, the 91st percentile. Fixed in libapache2-mod-auth-openidc 2.1.6-1.
References
github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLog
securityfocus.com/bid/96549
access.redhat.com/errata/RHSA-2019:2112
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-6413
security-tracker.debian.org/tracker/CVE-2017-6413
bugzilla.redhat.com/show_bug.cgi?id=1425350
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2112.json
cve.org/CVERecord?id=CVE-2017-6059
ubuntu.com/security/CVE-2017-6413