CVE-2021-39191

A open redirect flaw was found in mod_auth_openidc where it does not sanitize target_link_uri paramater properly. This issue could be used by a remote attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. As a result of this redirection victim users may give more credibility to the attacker controlled server because coming from a trusted application.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.