Openid vulnerabilities

2 vulnerabilities

Known vulnerabilities in Openid, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.8CVE-2007-5173openidopenid
EPSS score
2.80%
PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openid_root_path parameter.5.9CVE-2008-3280openidopenid
EPSS score
3.95%
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.