CVE-2019-11066: Lightopenid Project Lightopenid

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.

Affected products

• Lightopenid Project Lightopenid: up to and including 1.3.1

Published 2019-05-10. Last modified 2026-06-17.