CVE-2025-66029

Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.

• CWE-522
• CWE-523

• https://github.com/OSC/ondemand/security/advisories/GHSA-2cwp-8g29-9q32Mitigation, Vendor Advisory

Published

Dec 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66023NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …4.9
• CVE-2025-66024The XWiki blog application allows users of the XWiki platfor…9
• CVE-2025-66025Caido is a web security auditing toolkit. Prior to version 0…4.3
• CVE-2025-66026REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflec…6.1
• CVE-2025-66027Rallly is an open-source scheduling and collaboration tool. …6.5
• CVE-2025-66028OneUptime is a solution for monitoring and managing online s…8.2
• CVE-2025-6603A vulnerability was found in coldfunction qCUDA up to db0085…5.3
• CVE-2025-66030Forge (also called `node-forge`) is a native implementation …5.3
• CVE-2025-66031Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2025-66032Claude Code is an agentic coding tool. Prior to 1.0.93, Due …9.8
• CVE-2025-66033Okta Java Management SDK facilitates interactions with the O…5.3
• CVE-2025-66034fontTools is a library for manipulating fonts, written in Py…9.8