Skip to content

CVE-2016-2049 examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might al...

HighCVSS 8.8 EPSS 2.2%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted HTTP Host header.

Affected products

ProductAffected versionsFixed in
janrain php-openid All versions No fix listed

References