CVE-2017-6413

CVE-2017-6413 describes an authentication bypass vulnerability in the mod_auth_openidc module (versions prior to 2.1.6) for Apache HTTP Server. This flaw allows remote attackers to bypass authentication in "AuthType oauth20" configurations by sending crafted HTTP traffic that includes specific OIDC_CLAIM_ and OIDCAuthNHeader headers, which the module fails to properly ignore. The vulnerability carries a high CVSSv3 score of 8.6, indicating a network-based attack with low complexity, no privileges required, and a high impact on integrity, though without affecting confidentiality or availability. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.