SB2026081391 - Multiple vulnerabilities in mod_auth_openidc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081391

SB2026081391 - Multiple vulnerabilities in mod_auth_openidc

Published: August 13, 2026

Security Bulletin ID SB2026081391
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 13% Medium 50% Low 38%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject trusted identity headers into backend requests.

The vulnerability exists due to improper input validation in header scrubbing logic when handling unauthenticated request paths. A remote attacker can send crafted OIDC-related headers to inject trusted identity headers into backend requests.

Exploitation depends on the backend application trusting these headers as authenticated identity claims on affected paths.


2) Session Fixation (CVE-ID: N/A)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to hijack a victim\'s authenticated session.

The vulnerability exists due to improper session management in login session handling when processing authentication for a browser presenting an attacker-fixed session identifier. A remote attacker can set a chosen session cookie and wait for the victim to authenticate to hijack a victim\'s authenticated session.

The attacker must be able to set a cookie for the host before the victim logs in.


3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the victim\'s browser.

The vulnerability exists due to cross-site scripting in module-generated pages when rendering unescaped values into HTML attributes. A remote attacker can supply crafted redirect URI or provider metadata values to execute arbitrary script in the victim\'s browser.

This affects the discovery page and the auto-POST form, and exploitation requires a relative OIDCRedirectURI or attacker-influenced provider metadata.


4) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to influence authorization request parameters.

The vulnerability exists due to improper request validation in discovery response parameter handling when processing discovery responses without a valid CSRF check. A remote attacker can cause the victim\'s browser to submit crafted discovery response parameters to influence authorization request parameters.

This affects scopes and authorization request parameters carried on the discovery response.


5) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to alter authorization request parameters.

The vulnerability exists due to improper input validation in authorization request parameter handling when appending extra parameters that duplicate module-set values. A remote attacker can supply duplicate protocol parameters to alter authorization request parameters.

The impact depends on how the identity provider handles duplicated parameters.


6) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to revoke another user's tokens at the identity provider.

The vulnerability exists due to improper access control in front-channel logout handling when processing a logout request identified only by a sid and carrying no authenticated session. A remote attacker can send a crafted logout request naming a known sid to revoke another user's tokens at the identity provider.

Exploitation requires knowledge of a valid sid.


7) Authentication Bypass by Capture-replay (CVE-ID: N/A)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to replay back-channel logout tokens.

The vulnerability exists due to improper authentication in back-channel logout token validation when accepting logout tokens without required iat or jti claims. A remote attacker can resend a previously accepted logout token to replay back-channel logout tokens.

The affected behavior removes the freshness and replay protections provided by those claims.


8) Inclusion of Sensitive Information in Log Files (CVE-ID: N/A)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive credentials from debug logs.

The vulnerability exists due to insertion of sensitive information into log files in debug logging of provider responses and cookie values when writing unredacted response data to logs. A local user can read debug logs to disclose sensitive credentials from debug logs.

This includes tokens, client secrets, registration access tokens, and cookie values, and requires debug logging and log access.


Remediation

Install update from vendor's website.

References