https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:46:27.568884+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:1823 ALSA-2022:1823 — Moderate: mod_auth_openidc:2.3 security update 2026-10-03T18:46:27.756456+00:00

Affected: AlmaLinux:8: cjose, AlmaLinux:8: cjose-devel, AlmaLinux:8: mod_auth_openidc

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

* mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)

* mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)

* mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)

* mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2022-01677 bdu:2022-01677 2026-10-03T18:46:27.756543+00:00 bdu:2022-01677 https://cve.radiocsirt.org/vuln/euvd-2026-28122 EUVD-2026-28122 2026-10-03T18:46:27.756567+00:00 EUVD-2026-28122 https://cve.radiocsirt.org/vuln/fkie_cve-2021-32786 fkie_cve-2021-32786 2026-10-03T18:46:27.756585+00:00

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.

 https://cve.radiocsirt.org/vuln/gsd-2021-32786 gsd-2021-32786 2026-10-03T18:46:27.756621+00:00 gsd-2021-32786 https://cve.radiocsirt.org/vuln/msrc_cve-2021-32786 msrc_CVE-2021-32786 — Open Redirect in oidc_validate_redirect_url() 2026-10-03T18:46:27.756638+00:00 msrc_CVE-2021-32786 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1277-1 openSUSE-SU-2021:1277-1 — Security update for apache2-mod_auth_openidc 2026-10-03T18:46:27.756660+00:00

Security update for apache2-mod_auth_openidc

 https://cve.radiocsirt.org/vuln/suse-su-2021:3020-1 SUSE-SU-2021:3020-1 — Security update for apache2-mod_auth_openidc 2026-10-03T18:46:27.756686+00:00

Security update for apache2-mod_auth_openidc

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-32786 UBUNTU-CVE-2021-32786 2026-10-03T18:46:27.756710+00:00

Affected: Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0580 WID-SEC-W-2023-0580 — Red Hat Enterprise Linux (mod_auth_openidc): Mehrere Schwachstellen 2026-10-03T18:46:27.756747+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um falsche Informationen darzustellen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting Angriff durchzuführen.