Description
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zmartzone | mod_auth_openidc | < 2.4.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-auth-openidc | 2.4.9-1 | — |
| Debian 13 | libapache2-mod-auth-openidc | 2.4.9-1 | — |
| Debian 12 | libapache2-mod-auth-openidc | 2.4.9-1 | — |
| Debian 10 | libapache2-mod-auth-openidc | 2.3.10.2-1+deb10u2 | DLA-3409-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 18.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | cjose +1 | 0.6.1-2.module+el8+2454+f890a43a | RHSA-2022:1823 |
| RHEL 8 | mod_auth_openidc | 2.3.7-11.module+el8.6.0+14082+b6f23e95 | RHSA-2022:1823 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | cjose +1 | 0.6.1-2.module_el8.6.0+2868+44838709 | ALSA-2022:1823 |
| AlmaLinux 8 | mod_auth_openidc | 2.3.7-11.module_el8.6.0+2868+44838709 | ALSA-2022:1823 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | cjose | 0.6.1-2.module+el8.3.0+129+2feafa46 | RLSA-2022:1823 |
| Rocky Linux 8 | mod_auth_openidc | 2.3.7-11.module+el8.6.0+840+73eca44e | RLSA-2022:1823 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.14.1 | SUSE-SU-2025:4532-1 |
| SLES 15 SP6 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.14.1 | SUSE-SU-2025:4532-1 |
| SLES 15 SP3 | apache2-mod_auth_openidc | 2.3.8-3.15.1 | SUSE-SU-2021:3020-1 |
| SLES 15 SP2 | apache2-mod_auth_openidc | 2.3.8-3.15.1 | SUSE-SU-2021:3020-1 |
| SLES 12 SP5 | apache2-mod_auth_openidc | 2.4.0-3.23.1 | SUSE-SU-2021:3352-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | apache2-mod_auth_openidc | 2.4.0-3.23.1 | SUSE-SU-2021:3352-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_auth_openidc | 2.4.9.4-1.2 | openSUSE-SU-2024:10624-1 |
| openSUSE Leap 15.6 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.14.1 | SUSE-SU-2025:4532-1 |
| openSUSE Leap 15.3 | apache2-mod_auth_openidc | 2.3.8-3.15.1 | openSUSE-SU-2021:3020-1 |
| openSUSE Leap 15.2 | apache2-mod_auth_openidc | 2.3.8-lp152.5.6.1 | openSUSE-SU-2021:1277-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | httpd | 2.4.52-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | cjose +1 | 0.6.1-2.module+el8+5139+bcb28322 | ELSA-2022-1823 |
| Oracle Linux 8 | mod_auth_openidc | 2.3.7-11.module+el8.6.0+20572+b6f23e95 | ELSA-2022-1823 |
Advisories 12
- ALSA-2022:1823 Moderate: mod_auth_openidc:2.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- DLA-3409-1 libapache2-mod-auth-openidc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:1823 Moderate: mod_auth_openidc:2.3 security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:10624-1 apache2-mod_auth_openidc-2.4.9.4-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1277-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3020-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4532-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0580 Red Hat Enterprise Linux (mod_auth_openidc): Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 29, 2025
- RHSA-2022:1823 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2021:3020-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2021:3352-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2022-1823 Moderate: mod_auth_openidc:2.3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
References
- https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9
- https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-xm4c-5wm5-jqv7
- https://github.com/zmartzone/mod_auth_openidc/commit/3a115484eb927bc6daa5737dd84f88ff4bbc5544
- https://daniel.haxx.se/blog/2017/01/30/one-url-standard-please/
- FEDORA-2021-e3017c538a vendor-advisory
- FEDORA-2021-17f5cedf66 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20210902-0001/
- [debian-lts-announce] 20230430 [SECURITY] [DLA 3409-1] libapache2-mod-auth-openidc security update mailing-list