CVE-2016-2049

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

CVE-2016-2049

The CVE-2016-2049 entry describes a vulnerability in the JanRain PHP OpenID library (php-openid), where examples/consumer/common.php improperly compares the openid.realm parameter to the SERVER_NAME value from the SERVER superglobal. This mismatch can allow remote attackers to hijack user authent...