mod_auth_openidc is an authentication/authorization module f… (CVE-2021-32786)

Summary

Vulnerability reported (CVE-2021-32786). Risk of unauthorized operations or information disclosure. Exploitable via mod_auth_openidc.

Original description

The description as published by the source.

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, oidc_validate_redirect_url() does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring mod_auth_openidc to only allow redirection whose destination matches a given regular expression.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-32786 has been found.
Attackers can target a specific entry point like mod_auth_openidc over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "CVE-2021-32786" on the vendor's site.

CVE-2021-32786
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: mod_auth_openidc
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (unclassified) has been reported. Attackers reach the vulnerable code path via mod_auth_openidc without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions. Attack surface: mod_auth_openidc.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to the patched release per vendor advisory.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
資産台帳・SBOM・依存マニフェストで影響コンポーネントを特定する。
2
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID…

Summary

Original description

Auto-generated summary

Response actions

References