CVE-2016-2049

examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the…

published February 1, 2016

CVSS
—
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted HTTP Host header.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02171 · 82.0th percentile
Published
2016-02-01T21:00Z
EPSS history
Timeline
  • 01 FEB 21:00Z
    examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the…
    cvelistv5