CVE catalog

CVE-2021-32786

libapache2-mod-auth-openidc: CVE-2021-32786

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.36% · Oct 25, 2026

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibapache2-mod-auth-openidcsid2.4.20.3-1fixed
Debianlibapache2-mod-auth-openidcforky2.4.20.3-1fixed
Debianlibapache2-mod-auth-openidctrixie2.4.17-1fixed
Debianlibapache2-mod-auth-openidctrixie-security2.4.17-1+deb13u1fixed
Debianlibapache2-mod-auth-openidcbookworm2.4.12.3-2+deb12u4fixed
Debianlibapache2-mod-auth-openidcbookworm-security2.4.12.3-2+deb12u5fixed
Ubuntulibapache2-mod-auth-openidc18.042.1.6-1vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.1-2vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.2-1vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.2-1build1vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.3-1build1vulnerable
Ubuntulibapache2-mod-auth-openidc20.042.3.10.2-1vulnerable
Ubuntulibapache2-mod-auth-openidc20.042.4.0.4-1vulnerable
Ubuntulibapache2-mod-auth-openidc20.042.4.1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibapache2-mod-auth-openidcsourcesid2.4.9-1not yet assignedNot reported[991582]
Debianlibapache2-mod-auth-openidcsourceforky2.4.9-1not yet assignedNot reported[991582]
Debianlibapache2-mod-auth-openidcsourcetrixie2.4.9-1not yet assignedNot reported[991582]
Debianlibapache2-mod-auth-openidcsourcebookworm2.4.9-1not yet assignedNot reported[991582]

[Debian bug #991582]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libapache2-mod-auth-openidc]Unknown
    Details (4)

    • 2.4.12.3-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

    • 2.4.12.3-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

    • 2.4.12.3-2+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

    • 2.4.12.3-2+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

[Debian 13 (Trixie)]

  • [libapache2-mod-auth-openidc]Unknown
    Details (3)

    • 2.4.17-1 · amd64 · trixie

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · 13

    • 2.4.17-1 · arm64 · trixie

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · 13

    • 2.4.17-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]