{"id":"CVE-2021-32792","aliases":["ALSA-2022:1823","AZL-6482","DEBIAN-CVE-2021-32792","DLA-3409-1","EUVD-2021-19555","GHSA-458c-7pwg-3j7j","MGASA-2021-0452","RHSA-2022:1823","RLSA-2022:1823","SUSE-SU-2021:3020-1","SUSE-SU-2021:3352-1","SUSE-SU-2025:4532-1","UBUNTU-CVE-2021-32792","openSUSE-SU-2021:1277-1","openSUSE-SU-2021:3020-1"],"status":"published","title":"XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0151,"percentile":0.74808,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-07-26T00:00:00Z","modified":"2026-10-29T11:01:18Z","fixes":[{"ecosystem":"Azure Linux:2","package":"httpd","fixed_in":["2.4.52-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.module_el8.6.0+2868+44838709"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.module_el8.6.0+2868+44838709"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-11.module_el8.6.0+2868+44838709"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10.2-1+deb10u2"}]}],"versions":["2.3.10.2-1","2.3.10.2-1+deb10u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"apache-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+14082+b6f23e95"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+14082+b6f23e95"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+14082+b6f23e95"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8.3.0+129+2feafa46"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+840+73eca44e"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1","2.3.1-2","2.3.2-1","2.3.2-1build1","2.3.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10.2-1","2.4.0.4-1","2.4.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-lp152.5.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.15.1"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openidc","product":"mod_auth_openidc"},{"vendor":"zmartzone","product":"mod_auth_openidc"}],"references":[{"url":"https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-458c-7pwg-3j7j","tags":["x_transferred","Patch","Third Party Advisory","fix","article","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/commit/00c315cb0c8ab77c67be4a2ac08a71a83ac58751","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/commit/55ea0a085290cd2c8cdfdd960a230cbc38ba8b56","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXAWKPT5LXZSUTFSJ6IWSZC7RMYYQXQD/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1823.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-32786","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32791","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32792","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-39191","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32792","tags":["web","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32792","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0452.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29344","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-September/009431.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/54B4RYNP5L63X2FMX2QCVYB2LGLL42IY/","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1823","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001646","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1823.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32786","tags":["advisory"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-xm4c-5wm5-jqv7","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32791","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32791","tags":["advisory"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7j-3r9r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32792","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32792","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39191","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39191","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39191","tags":["advisory"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-2pgf-8h6h-gqg2","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1823","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213020-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188638","tags":["report"]},{"url":"https://bugzilla.suse.com/1188639","tags":["report"]},{"url":"https://bugzilla.suse.com/1188848","tags":["report"]},{"url":"https://bugzilla.suse.com/1188849","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32792","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190223","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39191","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254532-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248806","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3891","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32792","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4FGDDGUNYC724M4QGEPJORKASFRVKJ5V/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-32792","title":"XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","status":"published","published":"2021-07-26T00:00:00Z","modified":"2024-08-03T23:33:55.936Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-19555","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","status":"published","published":"2021-07-26T00:00:00Z","modified":"2024-08-03T23:33:55Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T03:24:35.30045Z"}],"nvd":[{"id":"CVE-2021-32792","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","status":"published","published":"2021-07-26T17:15:08.28Z","modified":"2026-06-17T03:53:38.377Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"AZL-6482","title":"CVE-2021-32792 affecting package httpd for versions less than 2.4.52-1","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","status":"published","published":"2021-07-26T17:15:08Z","modified":"2026-04-21T04:32:33.613777Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"CVE-2021-32792","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","status":"published","published":"2021-07-26T17:15:08.28Z","modified":"2026-10-24T14:21:14.981593708Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32792","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","status":"published","published":"2021-07-26T17:15:08.28Z","modified":"2026-10-23T18:03:14.078238444Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"RHSA-2022:1823","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2024-09-16T06:47:21Z","modified":"2025-11-22T12:33:27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1823","title":"Moderate: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)\n\n* mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)\n\n* mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)\n\n* mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:30:32Z","modified":"2026-02-04T19:15:12.519123Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-32792","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.","status":"published","published":"2021-07-26T17:15:00Z","modified":"2025-10-24T04:50:21Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"ALSA-2022:1823","title":"Moderate: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)\n\n* mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)\n\n* mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)\n\n* mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:30:32Z","modified":"2026-10-29T11:01:18.104762873Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-3409-1","title":"libapache2-mod-auth-openidc - security update","status":"published","published":"2023-04-30T00:00:00Z","modified":"2026-03-09T01:22:41.48677Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2021-0452","title":"Updated apache-mod_auth_openidc packages fix security vulnerability","description":"In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse\nURLs the same way as most browsers do. As a result, this function can be\nbypassed and leads to an Open Redirect vulnerability in the logout\nfunctionality. (CVE-2021-32786)\n\nIn mod_auth_openidc before version 2.4.9, the AES GCM encryption in\nmod_auth_openidc uses a static IV and AAD. It is important to fix because\nthis creates a static nonce and since aes-gcm is a stream cipher, this can\nlead to known cryptographic issues, since the same key is being reused.\n(CVE-2021-32791)\n\nIn mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in\nwhen using `OIDCPreservePost On`. (CVE-2021-32792)\n","status":"published","published":"2021-10-02T18:57:04Z","modified":"2026-04-16T04:42:45.726594338Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1277-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-09-16T10:07:24Z","modified":"2026-02-04T04:06:51.553747Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3020-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n","status":"published","published":"2021-09-13T07:17:23Z","modified":"2025-05-07T18:12:52.60292Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:3020-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n","status":"published","published":"2021-09-13T07:17:22Z","modified":"2026-02-04T03:53:51.602295Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3352-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n- CVE-2021-39191: open redirect issue in target_link_uri parameter (bsc#1190223)\n","status":"published","published":"2021-10-12T11:23:33Z","modified":"2025-05-02T04:10:41.445092Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2025:4532-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- Update to 2.4.17.1 (bsc#1248806 / PED-14130).\n- Remove many patches, as they've been merged upstream.\n  ","status":"published","published":"2025-12-29T13:53:59Z","modified":"2026-02-04T03:27:21.522575Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}