Cross-site request forgery in mod_auth_openidc - #VU142423
Published: August 13, 2026
Vulnerability identifier: #VU142423
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to influence authorization request parameters.
The vulnerability exists due to improper request validation in discovery response parameter handling when processing discovery responses without a valid CSRF check. A remote attacker can cause the victim\'s browser to submit crafted discovery response parameters to influence authorization request parameters.
This affects scopes and authorization request parameters carried on the discovery response.
Affected software
mod_auth_openidc
Remediation
Install security update from vendor's website.
mod_auth_openidc - update to 2.4.20.1