CVE-2021-39191

🗓️ 03 Sep 2021 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 205 Views🌐 WEB

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server vulnerable to open redirect attack

Reporter	Title	Published	Views	Family All 65
attackerkb	CVE-2021-39191	3 Sep 202114:15	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0135: mod_auth_openidc:2.3 (ALINUX3-SA-2022:0135)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2022:1823)	12 May 202200:00	–	nessus
Tenable Nessus	CentOS 8 : mod_auth_openidc:2.3 (CESA-2022:1823)	10 May 202200:00	–	nessus
Tenable Nessus	CentOS 9 : mod_auth_openidc-2.4.9.4-2.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: mod_auth_openidc / mod_auth_openidc-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0110)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel / etc Multiple Vulnerabilities (crlsa-2022_1823)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.6 [CIQ] Security Update: mod_auth_openidc Multiple Vulnerabilities (ciqsa-2026_1567)	1 Oct 202600:00	–	nessus
Tenable Nessus	Debian dla-3499 : libapache2-mod-auth-openidc - security update	19 Jul 202300:00	–	nessus
Tenable Nessus	Fedora 37 : mod_auth_openidc (2022-714b48d4d5)	14 Nov 202400:00	–	nessus

NVD

Vulners

Node

openidc mod_auth_openidcRange<2.4.9.4

Node

fedoraproject fedoraMatch35

fedoraproject fedoraMatch36

Node

debian debian_linuxMatch10.0

[
  {
    "vendor": "zmartzone",
    "product": "mod_auth_openidc",
    "versions": [
      {
        "version": "<=2.4.9.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-2pgf-8h6h-gqg2
lists	www.lists.debian.org/debian-lts-announce/2023/07/msg00020.html
github	www.github.com/zmartzone/mod_auth_openidc/issues/672
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32RGPW5LZDLDTB7MKZIGAHPSLFOUNWR5/
github	www.github.com/zmartzone/mod_auth_openidc/commit/03e6bfb446f4e3f27c003d30d6a433e5dd8e2b3d
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHXO4O4G2UQS7X6OQJCVZKHZAQ7SAIFB/
github	www.github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9.4

Parameter	Position	Path	Description	CWE
target_link_uri	query param	/init	The init SSO functionality of mod_auth_openidc is vulnerable to an open redirect attack when a crafted URL is supplied in the target_link_uri parameter.	CWE-601

17 Jun 2026 04:03Current

5.3Medium risk

Vulners AI Score5.3

CVSS 25.8

CVSS 3.14.7 - 6.1

EPSS0.01735

CWE-601