CVE-2019-14857
mod_auth_openidc before version 2.4.0.1 is vulnerable to a None
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
- Record
CVE-2019-14857- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2019-5978
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
- Record
EUVD-2019-5978- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-797h-qjwj-28jc
mod_auth_openidc before version 2.4.0.1 is vulnerable to a None
mod_auth_openidc before version 2.4.0.1 is vulnerable to a None
- Record
GHSA-797h-qjwj-28jc- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
- Record
CVE-2019-14857- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
- Record
CVE-2019-14857- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14857
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
- Record
DEBIAN-CVE-2019-14857- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVRHSA-2020:3032
Red Hat Security Advisory: mod_auth_openidc:2.3 security and bug fix update
- Record
RHSA-2020:3032- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2020:3970
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2020:3970- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRLSA-2020:3032
Moderate: mod_auth_openidc:2.3 security and bug fix update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
-
mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes (CVE-2019-14857)
-
mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash (CVE-2019-20479)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- Module stream mod_auth_openidc:2.3 does not have correct module.md file (BZ#1844107)
- Record
RLSA-2020:3032- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-14857
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
- Record
UBUNTU-CVE-2019-14857- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVALSA-2020:3032 No score
Moderate: mod_auth_openidc:2.3 security and bug fix update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
-
mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes (CVE-2019-14857)
-
mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash (CVE-2019-20479)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- Module stream mod_auth_openidc:2.3 does not have correct module.md file (BZ#1844107)
- Record
ALSA-2020:3032- Updated
- 2026-11-02
OSVMGASA-2019-0410 No score
Updated apache-mod_auth_openidc packages fix security vulnerability
The updated package fixes a security vulnerability:
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon. (CVE-2019-14857)
- Record
MGASA-2019-0410- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2499-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2019-14857: Fixed an open redirect issue that exists in URLs with trailing slashes (bsc#1153666).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2019:2499-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10624-1 No score
apache2-mod_auth_openidc-2.4.9.4-1.2 on GA media
These are all security issues fixed in the apache2-mod_auth_openidc-2.4.9.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10624-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2934-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2019-14857: Fixed an open redirect issue that exists in URLs with trailing slashes (bsc#1153666).
- Record
SUSE-SU-2019:2934-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2935-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2019-14857: Fixed an open redirect issue that exists in URLs with trailing slashes (bsc#1153666).
- Record
SUSE-SU-2019:2935-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4532-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- Update to 2.4.17.1 (bsc#1248806 / PED-14130).
- Remove many patches, as they've been merged upstream.
- Record
SUSE-SU-2025:4532-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cjoseAlmaLinux:8 |
before 0.6.1-2.module_el8.6.0+2868+44838709 | 0.6.1-2.module_el8.6.0+2868+44838709 |
cjose-develAlmaLinux:8 |
before 0.6.1-2.module_el8.6.0+2868+44838709 | 0.6.1-2.module_el8.6.0+2868+44838709 |
libapache2-mod-auth-openidcDebian:12 |
before 2.4.0.3-1 | 2.4.0.3-1 |
libapache2-mod-auth-openidcDebian:13 |
before 2.4.0.3-1 | 2.4.0.3-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.4.0.3-1 | 2.4.0.3-1 |
libapache2-mod-auth-openidcDebian:8 |
before 1.6.0-1+deb8u2, plus listed versions 1.6.0-11.6.0-1+deb8u1 |
1.6.0-1+deb8u2 |
libapache2-mod-auth-openidcDebian:9 |
before 2.1.6-1+deb9u1, plus listed versions 2.1.6-1 |
2.1.6-1+deb9u1 |
apache-mod_auth_openidcMageia:7 |
before 2.3.2-2.1.mga7 | 2.3.2-2.1.mga7 |
cjoseRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-2.module+el8+2454+f890a43a | 0:0.6.1-2.module+el8+2454+f890a43a |
cjose-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-2.module+el8+2454+f890a43a | 0:0.6.1-2.module+el8+2454+f890a43a |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cjose-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-2.module+el8+2454+f890a43a | 0:0.6.1-2.module+el8+2454+f890a43a |
cjose-develRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-2.module+el8+2454+f890a43a | 0:0.6.1-2.module+el8+2454+f890a43a |
mod_auth_openidcRed Hat:enterprise_linux:8::appstream |
before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3 | 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3 | 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3 | 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3 |
mod_auth_openidcRed Hat:enterprise_linux:7::server |
before 0:1.8.8-7.el7 | 0:1.8.8-7.el7 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:7::server |
before 0:1.8.8-7.el7 | 0:1.8.8-7.el7 |
mod_auth_openidcRed Hat:enterprise_linux:7::workstation |
before 0:1.8.8-7.el7 | 0:1.8.8-7.el7 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:1.8.8-7.el7 | 0:1.8.8-7.el7 |
cjoseRocky Linux:8 |
before 0:0.6.1-2.module+el8.3.0+129+2feafa46 | 0:0.6.1-2.module+el8.3.0+129+2feafa46 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP1 |
before 2.3.8-3.3.1 | 2.3.8-3.3.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP4 |
before 2.4.0-3.7.1 | 2.4.0-3.7.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.4.0-3.7.1 | 2.4.0-3.7.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
libapache2-mod-auth-openidcUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.8.5-1 |
None known |
libapache2-mod-auth-openidcUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-12.3.1-22.3.2-12.3.2-1build12.3.3-1build1 |
None known |
apache2-mod_auth_openidcopenSUSE:Leap 15.1 |
before 2.3.8-lp151.2.3.1 | 2.3.8-lp151.2.3.1 |
apache2-mod_auth_openidcopenSUSE:Tumbleweed |
before 2.4.9.4-1.2 | 2.4.9.4-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14857 is a medium vulnerability (CVSS 5.8) in [unknown] Mod Auth Openidc, published November 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in cjose 0.6.1-2.module_el8.6.0+2868+44838709.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14857
github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75
groups.google.com/forum
lists.debian.org/debian-lts-announce/2020/07/msg00028.html
Show 43 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-14857
errata.almalinux.org/8/ALSA-2020-3032.html
vulners.com/cve/CVE-2019-14857
security-tracker.debian.org/tracker/CVE-2019-14857
advisories.mageia.org/MGASA-2019-0410.html
bugs.mageia.org/show_bug.cgi?id=25810
lists.opensuse.org/opensuse-updates/2019-11/msg00078.html
access.redhat.com/errata/RHSA-2020:3032
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3032.json
cve.org/CVERecord?id=CVE-2019-14857
errata.rockylinux.org/RLSA-2020:3032
suse.com/support/update/announcement/2019/suse-su-20192934-1
bugzilla.suse.com/1153666
ubuntu.com/security/CVE-2019-14857