CVE-2017-6413

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.

• CWE-287

• http://www.securityfocus.com/bid/96549
• https://access.redhat.com/errata/RHSA-2019:2112
• https://github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLogIssue Tracking, Patch, Third Party Advisory
• https://github.com/pingidentity/mod_auth_openidc/commit/21e3728a825c41ab41efa75e664108051bb9665eIssue Tracking, Patch, Third Party Advisory
• https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.6Patch, Release Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V3HIGXMUKJGOBMAQAQPGC7G5YYWSUVA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTWUMQ46GZY3O4WU4JCF333LN53R2XQH/
• http://www.securityfocus.com/bid/96549
• https://access.redhat.com/errata/RHSA-2019:2112
• https://github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLogIssue Tracking, Patch, Third Party Advisory
• https://github.com/pingidentity/mod_auth_openidc/commit/21e3728a825c41ab41efa75e664108051bb9665eIssue Tracking, Patch, Third Party Advisory
• https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.6Patch, Release Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V3HIGXMUKJGOBMAQAQPGC7G5YYWSUVA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTWUMQ46GZY3O4WU4JCF333LN53R2XQH/

Published

Mar 2, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6407An issue was discovered in Veritas NetBackup Before 7.7.2 an…
• CVE-2017-6408An issue was discovered in Veritas NetBackup 8.0 and earlier…
• CVE-2017-6409An issue was discovered in Veritas NetBackup 8.0 and earlier…
• CVE-2017-6410kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.…
• CVE-2017-6411Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_…
• CVE-2017-6412In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixati…
• CVE-2017-6414Memory leak in the vcard_apdu_new function in card_7816.c in…6.5
• CVE-2017-6415The dex_parse_debug_item function in libr/bin/p/bin_dex.c in…5.5
• CVE-2017-6416An issue was discovered in SysGauge 1.5.18. A buffer overflo…
• CVE-2017-6417Code injection vulnerability in Avira Total Security Suite 1…
• CVE-2017-6418libclamav/message.c in ClamAV 0.99.2 allows remote attackers…
• CVE-2017-6419mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.…