Skip to content
Fencer Vulns
medium 4.7

CVE-2022-23527 json

Open Redirect in oidc_validate_redirect_url()

published 2022-12-14 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-28556

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.

Patch / fix

  • openidc mod_auth_openidc 2.4.12.2
  • libapache2-mod-auth-openidc Debian 14, Debian 13, Debian 12 2.4.12.2-1

debian advisories DEBIAN-CVE-2022-23527

  • cjose RHEL 8 0.6.1-4.module+el8.9.0+19469+5b493da9
  • mod_auth_openidc RHEL 8 2.4.9.4-5.module+el8.9.0+18723+672ccf5d
  • mod_auth_openidc RHEL 9 2.4.9.4-4.el9

red hat advisories RHSA-2023:6940RHSA-2023:6365

  • apache2-mod_auth_openidc SLE Module for Server Applications 15 SP7, SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 2.4.17.1-150600.16.14.1
  • apache2-mod_auth_openidc SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 2.4.0-7.9.1
  • apache2-mod_auth_openidc SLE Real Time 15 SP3, SLE Module for Server Applications 15 SP4, openSUSE Leap 15.4 2.3.8-150100.3.22.1

suse advisories SUSE-SU-2025:4532-1SUSE-SU-2023:1837-1SUSE-SU-2023:0215-1

  • apache2-mod_auth_openidc openSUSE Tumbleweed 2.4.12.2-1.1

opensuse advisories openSUSE-SU-2024:12584-1

  • cjose AlmaLinux 8 0.6.1-4.module_el8.9.0+3631+0ced13d7
  • mod_auth_openidc AlmaLinux 8 2.4.9.4-5.module_el8.9.0+3631+0ced13d7
  • mod_auth_openidc AlmaLinux 9 2.4.9.4-4.el9

almalinux advisories ALSA-2023:6940ALSA-2023:6365

  • cjose Rocky Linux 8 0.6.1-4.module+el8.9.0+1384+4b58c166
  • mod_auth_openidc Rocky Linux 8 2.4.9.4-5.module+el8.9.0+1384+4b58c166

rocky linux advisories RLSA-2023:6940

  • mod_auth_openidc CBL-Mariner 2.0 2.4.14.2-1

azure linux advisories AZL-11653

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23527 updated cvss 6.1

mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character

  • Red Hat Enterprise Linux 7 mod_auth_openidc
    affected: workaround, no fix planned “This vulnerability can mitigated by configuring mod_auth_openidc to only allow redirection whose destination matches a given regular expression with OIDCRedirectURLsAllowed.”
  • Red Hat Enterprise Linux AppStream (v. 8) cjose 0.6.1-4.module+el8.9.0+19469+5b493da9, mod_auth_openidc 2.4.9.4-5.module+el8.9.0+18723+672ccf5d
    fixed: vendor fix “This vulnerability can mitigated by configuring mod_auth_openidc to only allow redirection whose destination matches a given regular expression with OIDCRedirectURLsAllowed.” RHSA-2023:6940
  • Red Hat Enterprise Linux AppStream (v. 9) mod_auth_openidc 2.4.9.4-4.el9
    fixed: vendor fix “This vulnerability can mitigated by configuring mod_auth_openidc to only allow redirection whose destination matches a given regular expression with OIDCRedirectURLsAllowed.” RHSA-2023:6365

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

  • zmartzone mod_auth_openidc

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.