CVE-2017-6062
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module...
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
CVE-2017-6062- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
CVE-2017-6062- Updated
- 2026-11-02
EUVDEUVD-2017-15130 No score
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
EUVD-2017-15130- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5fhw-rc3x-vmxm
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module...
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
GHSA-5fhw-rc3x-vmxm- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
CVE-2017-6062- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6062
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
DEBIAN-CVE-2017-6062- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6062
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- Record
UBUNTU-CVE-2017-6062- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-openidcDebian:12 |
before 2.1.5-1 | 2.1.5-1 |
libapache2-mod-auth-openidcDebian:13 |
before 2.1.5-1 | 2.1.5-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.1.5-1 | 2.1.5-1 |
libapache2-mod-auth-openidcUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.8.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6062 is a high vulnerability (CVSS 8.6) in Openidc Mod Auth Openidc, published March 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.63%, the 89th percentile. Fixed in libapache2-mod-auth-openidc 2.1.5-1.
References
github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.5
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-6062
security-tracker.debian.org/tracker/CVE-2017-6062
ubuntu.com/security/CVE-2017-6062
cve.org/CVERecord?id=CVE-2017-6062