CVE-2022-23527
Open Redirect in oidc_validate_redirect_url()
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Open Redirect in oidc_validate_redirect_url()
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Record
CVE-2022-23527- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2022-28556
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Record
EUVD-2022-28556- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
NVD
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Record
CVE-2022-23527- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVAZL-11653
CVE-2022-23527 affecting package mod_auth_openidc for versions less than 2.4.14.2-1
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Record
AZL-11653- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
Open Redirect in oidc_validate_redirect_url()
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Record
CVE-2022-23527- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVOESA-2023-1235
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.(CVE-2022-23527)
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using OIDCStripCookies.(CVE-2023-28625)
- Record
OESA-2023-1235- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVOESA-2023-1236
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.(CVE-2022-23527)
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using OIDCStripCookies.(CVE-2023-28625)
- Record
OESA-2023-1236- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:6365
Red Hat Security Advisory: mod_auth_openidc security and bug fix update
- Record
RHSA-2023:6365- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:6940
Red Hat Security Advisory: mod_auth_openidc:2.3 security and bug fix update
- Record
RHSA-2023:6940- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-23527
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Record
UBUNTU-CVE-2022-23527- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVALSA-2023:6365 No score
Moderate: mod_auth_openidc security and bug fix update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)
- mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied (CVE-2023-28625)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:6365- Updated
- 2026-11-02
OSVALSA-2023:6940 No score
Moderate: mod_auth_openidc:2.3 security and bug fix update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)
- mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied (CVE-2023-28625)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:6940- Updated
- 2026-11-02
OSVCLSA-2025-1753800294 No score
mod_auth_openidc: Fix of CVE-2022-23527
- CVE-2022-23527: fix open redirect vulnerability caused by improper URL validation
- Record
CLSA-2025-1753800294- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-23527 No score
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Record
DEBIAN-CVE-2022-23527- Updated
- 2026-11-03
OSVopenSUSE-SU-2024:12584-1 No score
apache2-mod_auth_openidc-2.4.12.2-1.1 on GA media
These are all security issues fixed in the apache2-mod_auth_openidc-2.4.12.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12584-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0215-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2022-23527: Fixed open redirect in oidc_validate_redirect_url() using tab character (bsc#1206441).
- CVE-2021-39191: Fixed open redirect issue in target_link_uri parameter (bsc#1190223).
- Record
SUSE-SU-2023:0215-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1837-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2022-23527: Fixed open redirect in oidc_validate_redirect_url() using tab character (bsc#1206441).
- CVE-2023-28625: Fixed NULL pointer dereference when OIDCStripCookies was set and a crafted Cookie header was supplied (bsc#1210073).
- Record
SUSE-SU-2023:1837-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4532-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- Update to 2.4.17.1 (bsc#1248806 / PED-14130).
- Remove many patches, as they've been merged upstream.
- Record
SUSE-SU-2025:4532-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mod_auth_openidcAlmaLinux:9 |
before 2.4.9.4-4.el9 | 2.4.9.4-4.el9 |
cjoseAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
cjose-develAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
mod_auth_openidcAlmaLinux:8 |
before 2.4.9.4-5.module_el8.9.0+3631+0ced13d7 | 2.4.9.4-5.module_el8.9.0+3631+0ced13d7 |
mod_auth_openidcAzure Linux:2 |
before 2.4.14.2-1 | 2.4.14.2-1 |
mod_auth_openidcTuxCare:AlmaLinux:9.2 |
before 2.4.9.4-1.el9.tuxcare.els5 | 2.4.9.4-1.el9.tuxcare.els5 |
libapache2-mod-auth-openidcDebian:12 |
before 2.4.12.2-1 | 2.4.12.2-1 |
libapache2-mod-auth-openidcDebian:13 |
before 2.4.12.2-1 | 2.4.12.2-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.4.12.2-1 | 2.4.12.2-1 |
libapache2-mod-auth-openidcDebian:10 |
before 2.3.10.2-1+deb10u3, plus listed versions 2.3.10.2-12.3.10.2-1+deb10u12.3.10.2-1+deb10u2 |
2.3.10.2-1+deb10u3 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_auth_openidcopenEuler:22.03-LTS |
before 2.4.13.2-1.oe2203 | 2.4.13.2-1.oe2203 |
mod_auth_openidcopenEuler:22.03-LTS-SP1 |
before 2.4.13.2-1.oe2203sp1 | 2.4.13.2-1.oe2203sp1 |
mod_auth_openidcRed Hat:enterprise_linux:9::appstream |
before 0:2.4.9.4-4.el9 | 0:2.4.9.4-4.el9 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.4.9.4-4.el9 | 0:2.4.9.4-4.el9 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:2.4.9.4-4.el9 | 0:2.4.9.4-4.el9 |
cjoseRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.9.0+19469+5b493da9 | 0:0.6.1-4.module+el8.9.0+19469+5b493da9 |
cjose-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.9.0+19469+5b493da9 | 0:0.6.1-4.module+el8.9.0+19469+5b493da9 |
cjose-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.9.0+19469+5b493da9 | 0:0.6.1-4.module+el8.9.0+19469+5b493da9 |
cjose-develRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.9.0+19469+5b493da9 | 0:0.6.1-4.module+el8.9.0+19469+5b493da9 |
mod_auth_openidcRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-5.module+el8.9.0+18723+672ccf5d | 0:2.4.9.4-5.module+el8.9.0+18723+672ccf5d |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-5.module+el8.9.0+18723+672ccf5d | 0:2.4.9.4-5.module+el8.9.0+18723+672ccf5d |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-5.module+el8.9.0+18723+672ccf5d | 0:2.4.9.4-5.module+el8.9.0+18723+672ccf5d |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP4 |
before 2.3.8-150100.3.22.1 | 2.3.8-150100.3.22.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Real Time 15 SP3 |
before 2.3.8-150100.3.22.1 | 2.3.8-150100.3.22.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.4 |
before 2.3.8-150100.3.22.1 | 2.3.8-150100.3.22.1 |
apache2-mod_auth_openidcSUSE:OpenStack Cloud 9 |
before 2.4.0-7.9.1 | 2.4.0-7.9.1 |
apache2-mod_auth_openidcSUSE:OpenStack Cloud Crowbar 9 |
before 2.4.0-7.9.1 | 2.4.0-7.9.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.4.0-7.9.1 | 2.4.0-7.9.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP4-ESPOS |
before 2.4.0-7.9.1 | 2.4.0-7.9.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 2.4.0-7.9.1 | 2.4.0-7.9.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP5 |
before 2.4.0-7.9.1 | 2.4.0-7.9.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.4.0-7.9.1 | 2.4.0-7.9.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
libapache2-mod-auth-openidcUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-12.3.1-22.3.2-12.3.2-1build12.3.3-1build1 |
None known |
libapache2-mod-auth-openidcUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.10.2-12.4.0.4-12.4.1-1 |
None known |
libapache2-mod-auth-openidcUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.9-12.4.9.4-12.4.10-12.4.10-1build12.4.11-12.4.11-1ubuntu0.1 |
None known |
apache2-mod_auth_openidcopenSUSE:Tumbleweed |
before 2.4.12.2-1.1 | 2.4.12.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23527 is a medium vulnerability (CVSS 4.7) in Debian Linux, published December 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in mod_auth_openidc 2.4.9.4-4.el9.
References
github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53
lists.debian.org/debian-lts-announce/2023/07/msg00020.html
access.redhat.com/errata/RHSA-2023:6365
Show 48 moreShow less
bugzilla.redhat.com/2153655
errata.almalinux.org/9/ALSA-2023-6365.html
nvd.nist.gov/vuln/detail/CVE-2022-23527
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1753800294.html
security-tracker.debian.org/tracker/CVE-2022-23527
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1235
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6365.json
cve.org/CVERecord?id=CVE-2022-23527
suse.com/support/update/announcement/2023/suse-su-20230215-1
bugzilla.suse.com/1190223
ubuntu.com/security/CVE-2022-23527