CVE-2019-3878

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse...

8.1 HighFix available

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

2.97%Up 0.8 points since Apr 14, 2021

What each source reports

CVE List Score used 8.1

Record: CVE-2019-3878
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-305
Updated: 2026-11-02

EUVDEUVD-2019-13489 8.1

Record: EUVD-2019-13489
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6gx9-985p-w8c8 8.1

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse...

Record: GHSA-6gx9-985p-w8c8
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287
Updated: 2026-11-02

NVD 8.1

Record: CVE-2019-3878
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-305, CWE-287
Updated: 2026-11-02

OSV 8.1

Record: CVE-2019-3878
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-3878 8.1

Record: DEBIAN-CVE-2019-3878
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVRHSA-2019:0746 8.8

Red Hat Security Advisory: httpd24-httpd and httpd24-mod_auth_mellon security update

Record: RHSA-2019:0746
CVSS 3.0: 8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:0766 8.1

Red Hat Security Advisory: mod_auth_mellon security and bug fix update

Record: RHSA-2019:0766
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2019:0985 8.1

Red Hat Security Advisory: mod_auth_mellon security update

Record: RHSA-2019:0985
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-3878 8.1

Record: UBUNTU-CVE-2019-3878
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUSN-3924-1 No score

libapache2-mod-auth-mellon vulnerabilities

It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. (CVE-2019-3877)

It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2019-3878)

Record: USN-3924-1
Updated: 2026-11-02

OSVUSN-4597-1 No score

libapache2-mod-auth-mellon vulnerabilities

François Kooman discovered that mod_auth_mellon incorrectly handled cookies. An attacker could possibly use this issue to cause a Cross-Site Session Transfer attack. (CVE-2017-6807)

It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. (CVE-2019-3877)

It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2019-3878)

Record: USN-4597-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libapache2-mod-auth-mellon` Debian:12	before 0.14.2-1	0.14.2-1
`libapache2-mod-auth-mellon` Debian:13	before 0.14.2-1	0.14.2-1
`libapache2-mod-auth-mellon` Debian:14	before 0.14.2-1	0.14.2-1
`libapache2-mod-auth-mellon` Debian:9 From an advisory covering 2 CVEs	before 0.12.0-2+deb9u1, plus listed versions 0.12.0-2	0.12.0-2+deb9u1
`httpd24-httpd` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 0:2.4.34-7.el6.1	0:2.4.34-7.el6.1
`httpd24-httpd-debuginfo` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 0:2.4.34-7.el6.1	0:2.4.34-7.el6.1
`httpd24-httpd-devel` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 0:2.4.34-7.el6.1	0:2.4.34-7.el6.1
`httpd24-httpd-manual` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 0:2.4.34-7.el6.1	0:2.4.34-7.el6.1
`httpd24-httpd-tools` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 0:2.4.34-7.el6.1	0:2.4.34-7.el6.1
`httpd24-mod_ldap` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 0:2.4.34-7.el6.1	0:2.4.34-7.el6.1

Show 30 moreShow less

Affected packages
Package	Affected	Fixed
`httpd24-mod_proxy_html` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 1:2.4.34-7.el6.1	1:2.4.34-7.el6.1
`httpd24-mod_session` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 0:2.4.34-7.el6.1	0:2.4.34-7.el6.1
`httpd24-mod_ssl` Red Hat:rhel_software_collections:3::el6 From an advisory covering 2 CVEs	before 1:2.4.34-7.el6.1	1:2.4.34-7.el6.1
`httpd24-httpd` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-httpd-debuginfo` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-httpd-devel` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-httpd-manual` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-httpd-tools` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-mod_auth_mellon` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:0.13.1-2.el7.1	0:0.13.1-2.el7.1
`httpd24-mod_auth_mellon-debuginfo` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:0.13.1-2.el7.1	0:0.13.1-2.el7.1
`httpd24-mod_ldap` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-mod_md` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-mod_proxy_html` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 1:2.4.34-7.el7.1	1:2.4.34-7.el7.1
`httpd24-mod_session` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 0:2.4.34-7.el7.1	0:2.4.34-7.el7.1
`httpd24-mod_ssl` Red Hat:rhel_software_collections:3::el7 From an advisory covering 2 CVEs	before 1:2.4.34-7.el7.1	1:2.4.34-7.el7.1
`mod_auth_mellon` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:0.14.0-2.el7_6.4	0:0.14.0-2.el7_6.4
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:0.14.0-2.el7_6.4	0:0.14.0-2.el7_6.4
`mod_auth_mellon-diagnostics` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:0.14.0-2.el7_6.4	0:0.14.0-2.el7_6.4
`mod_auth_mellon` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:0.14.0-2.el7_6.4	0:0.14.0-2.el7_6.4
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:0.14.0-2.el7_6.4	0:0.14.0-2.el7_6.4
`mod_auth_mellon-diagnostics` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:0.14.0-2.el7_6.4	0:0.14.0-2.el7_6.4
`mod_auth_mellon` Red Hat:enterprise_linux:8::appstream	before 0:0.14.0-3.el8_0.2	0:0.14.0-3.el8_0.2
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:0.14.0-3.el8_0.2	0:0.14.0-3.el8_0.2
`mod_auth_mellon-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:0.14.0-3.el8_0.2	0:0.14.0-3.el8_0.2
`mod_auth_mellon-diagnostics-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:0.14.0-3.el8_0.2	0:0.14.0-3.el8_0.2
`libapache2-mod-auth-mellon` Ubuntu:16.04:LTS	before 0.12.0-2+deb9u1build0.16.04.1, plus listed versions 0.10.0-10.11.0-10.12.0-1	0.12.0-2+deb9u1build0.16.04.1
`libapache2-mod-auth-mellon` Ubuntu:18.04:LTS	before 0.13.1-1ubuntu0.1, plus listed versions 0.13.1-10.13.1-1build10.13.1-1build2	0.13.1-1ubuntu0.1
`libapache2-mod-auth-mellon` Ubuntu:20.04:LTS	before 0.14.2-1ubuntu1	0.14.2-1ubuntu1
`libapache2-mod-auth-mellon` Ubuntu:18.04:LTS From an advisory covering 2 CVEs	before 0.13.1-1ubuntu0.1, plus listed versions 0.13.1-10.13.1-1build10.13.1-1build2	0.13.1-1ubuntu0.1
`libapache2-mod-auth-mellon` Ubuntu:16.04:LTS From an advisory covering 3 CVEs	before 0.12.0-2+deb9u1build0.16.04.1, plus listed versions 0.10.0-10.11.0-10.12.0-1	0.12.0-2+deb9u1build0.16.04.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-3878 is a high vulnerability (CVSS 8.1) in Canonical Ubuntu Linux, published March 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.97%, the 87th percentile. Fixed in libapache2-mod-auth-mellon 0.14.2-1.

References

Show 32 moreShow less