CVE-2022-23527

An open redirect vulnerability was found in mod_auth_openidc, an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability can mitigated by configuring mod_auth_openidc to only allow redirection whose destination matches a given regular expression with OIDCRedirectURLsAllowed.