CVE-2019-20479 in mod_auth_openidc
Summary
by MITRE
A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/02/2026
The vulnerability identified as CVE-2019-20479 represents a critical open redirect flaw within the mod_auth_openidc module, which is a widely deployed Apache HTTP server module for OpenID Connect authentication. This module serves as a bridge between Apache servers and OpenID Connect identity providers, enabling single sign-on functionality across numerous web applications and services. The flaw specifically manifests in versions prior to 2.4.1, where improper input validation allows attackers to manipulate redirect URLs through carefully crafted paths containing both forward slashes and backslashes at the beginning of the URL structure. The vulnerability stems from insufficient sanitization of redirect parameters that are processed during the authentication flow, creating an avenue for malicious actors to redirect users to arbitrary destinations while maintaining the appearance of legitimate authentication endpoints.
The technical nature of this flaw aligns with CWE-601, which categorizes open redirect vulnerabilities as weaknesses where web applications redirect users to external sites without proper validation of the destination URL. In the context of mod_auth_openidc, the vulnerability exploits the module's handling of URL parsing where the presence of both slash and backslash characters at the beginning of redirect URLs bypasses normal validation mechanisms. This occurs because the authentication module fails to properly canonicalize or sanitize the redirect URLs before processing them, allowing attackers to inject malicious redirect targets that can be leveraged for phishing attacks or credential theft. The specific combination of slash and backslash characters creates a parsing ambiguity that the module's validation logic cannot adequately address, enabling attackers to manipulate the intended redirect behavior.
From an operational perspective, this vulnerability presents significant security risks to organizations relying on mod_auth_openidc for authentication services. Attackers can exploit this flaw by crafting malicious URLs that appear to originate from legitimate authentication endpoints, potentially fooling users into visiting malicious sites where credentials or sensitive information can be harvested. The impact extends beyond simple phishing attacks as the vulnerability can be combined with other techniques to create more sophisticated attack vectors. Security professionals must consider that this flaw can be exploited in conjunction with social engineering campaigns, where users might be directed to malicious sites through compromised links or malicious advertisements. The vulnerability particularly affects environments where users trust the authentication infrastructure and are not suspicious of redirects originating from what appears to be legitimate authentication endpoints.
Organizations should prioritize immediate remediation by upgrading to mod_auth_openidc version 2.4.1 or later, which includes proper input validation and URL sanitization mechanisms. Additional mitigations include implementing strict access controls on authentication endpoints, monitoring for suspicious redirect patterns in web server logs, and educating users about the dangers of unexpected redirects. The vulnerability also highlights the importance of comprehensive input validation in authentication modules, as outlined in the OWASP Top Ten and MITRE ATT&CK framework's defensive strategies for credential access and defense evasion techniques. Security teams should conduct thorough vulnerability assessments to identify systems running affected versions and implement network segmentation to limit the potential impact of exploitation attempts. Regular security updates and patch management processes become critical in preventing exploitation of such authentication-related vulnerabilities that can compromise entire user authentication infrastructures.