CVE-2021-39191

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.9.4

Description The mod auth openidc module for the Apache 2.x HTTP server is vulnerable to an open redirect attack. This occurs when a crafted URL is supplied in the target link uri parameter, affecting the 3rd-party init SSO functionality. A patch in version 2.4.9.4 applies the OIDCRedirectURLsAllowed setting to the target link uri parameter, mitigating the issue.

Recommendations For mod auth openidc versions prior to 2.4.9.4, upgrade to a patched version, specifically version 2.4.9.4 or later, to resolve the issue. As a temporary workaround, consider restricting the use of the target link uri parameter until a patch is applied. Additionally, ensure the OIDCRedirectURLsAllowed setting is properly configured to minimize the risk of exploitation.