{"id":"CVE-2021-39191","aliases":["ALSA-2022:1823","AZL-7289","DEBIAN-CVE-2021-39191","DLA-3499-1","EUVD-2021-25579","GHSA-2pgf-8h6h-gqg2","RHSA-2022:1823","RLSA-2022:1823","SUSE-SU-2021:3352-1","SUSE-SU-2023:0215-1","SUSE-SU-2025:4532-1","UBUNTU-CVE-2021-39191"],"status":"published","title":"URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01735,"percentile":0.77968,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2021-09-03T00:00:00Z","modified":"2026-10-29T11:01:18Z","fixes":[{"ecosystem":"Azure Linux:2","package":"mod_auth_openidc","fixed_in":["2.4.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.module_el8.6.0+2868+44838709"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.module_el8.6.0+2868+44838709"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-11.module_el8.6.0+2868+44838709"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10.2-1+deb10u3"}]}],"versions":["2.3.10.2-1","2.3.10.2-1+deb10u1","2.3.10.2-1+deb10u2"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+14082+b6f23e95"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+14082+b6f23e95"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+14082+b6f23e95"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8.3.0+129+2feafa46"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-11.module+el8.6.0+840+73eca44e"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1","2.3.1-2","2.3.2-1","2.3.2-1build1","2.3.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10.2-1","2.4.0.4-1","2.4.1-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openidc","product":"mod_auth_openidc"},{"vendor":"zmartzone","product":"mod_auth_openidc"}],"references":[{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-2pgf-8h6h-gqg2","tags":["x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/issues/672","tags":["x_transferred","Exploit","evidence","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/commit/03e6bfb446f4e3f27c003d30d6a433e5dd8e2b3d","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9.4","tags":["x_transferred","Release Notes","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32RGPW5LZDLDTB7MKZIGAHPSLFOUNWR5/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHXO4O4G2UQS7X6OQJCVZKHZAQ7SAIFB/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","article"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1823.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-32786","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32791","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32792","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-39191","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39191","tags":["web","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-39191","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1823","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001646","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1823.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32786","tags":["advisory"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-xm4c-5wm5-jqv7","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32791","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32791","tags":["advisory"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7j-3r9r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32792","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32792","tags":["advisory"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-458c-7pwg-3j7j","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39191","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39191","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1823","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188638","tags":["report"]},{"url":"https://bugzilla.suse.com/1188639","tags":["report"]},{"url":"https://bugzilla.suse.com/1188848","tags":["report"]},{"url":"https://bugzilla.suse.com/1188849","tags":["report"]},{"url":"https://bugzilla.suse.com/1190223","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39191","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230215-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199868","tags":["report"]},{"url":"https://bugzilla.suse.com/1206441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23527","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254532-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248806","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3891","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-39191","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-39191","title":"URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","status":"published","published":"2021-09-03T00:00:00Z","modified":"2024-08-04T01:58:18.283Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:33:09.540052Z"}],"euvd":[{"id":"EUVD-2021-25579","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","status":"published","published":"2021-09-03T00:00:00Z","modified":"2024-08-04T01:58:18Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:24:23.719378Z"}],"nvd":[{"id":"CVE-2021-39191","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","status":"published","published":"2021-09-03T14:15:07.21Z","modified":"2026-06-17T04:03:16.853Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:06:58.05696Z"}],"osv":[{"id":"AZL-7289","title":"CVE-2021-39191 affecting package mod_auth_openidc for versions less than 2.4.14.2-1","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","status":"published","published":"2021-09-03T14:15:07Z","modified":"2026-04-21T04:33:44.958503Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2021-39191","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","status":"published","published":"2021-09-03T14:15:07.21Z","modified":"2026-10-24T14:25:20.854363074Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-39191","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","status":"published","published":"2021-09-03T14:15:07.21Z","modified":"2026-10-23T18:03:50.474491224Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"RHSA-2022:1823","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2024-09-16T06:47:21Z","modified":"2025-11-22T12:33:27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1823","title":"Moderate: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)\n\n* mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)\n\n* mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)\n\n* mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:30:32Z","modified":"2026-02-04T19:15:12.519123Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-39191","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.","status":"published","published":"2021-09-03T14:15:00Z","modified":"2025-10-24T04:50:29Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"ALSA-2022:1823","title":"Moderate: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)\n\n* mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)\n\n* mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)\n\n* mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:30:32Z","modified":"2026-10-29T11:01:18.104762873Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-3499-1","title":"libapache2-mod-auth-openidc - security update","status":"published","published":"2023-07-19T00:00:00Z","modified":"2026-03-09T01:21:59.265938Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"SUSE-SU-2021:3352-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n- CVE-2021-39191: open redirect issue in target_link_uri parameter (bsc#1190223)\n","status":"published","published":"2021-10-12T11:23:33Z","modified":"2025-05-02T04:10:41.445092Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2023:0215-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2022-23527: Fixed open redirect in oidc_validate_redirect_url() using tab character (bsc#1206441).\n- CVE-2021-39191: Fixed open redirect issue in target_link_uri parameter (bsc#1190223).\n","status":"published","published":"2023-01-30T16:27:28Z","modified":"2026-02-04T03:38:17.414969Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2025:4532-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- Update to 2.4.17.1 (bsc#1248806 / PED-14130).\n- Remove many patches, as they've been merged upstream.\n  ","status":"published","published":"2025-12-29T13:53:59Z","modified":"2026-02-04T03:27:21.522575Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}