CVE-2021-3639: Uninett Mod Auth Mellon

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.

Affected products

• Uninett Mod Auth Mellon: before 0.18.0 (fixed in 0.18.0)

Published 2022-08-22. Last modified 2026-06-17.