CVE-2019-3878

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

Published: Mar 26, 2019
Updated: Nov 9, 2025
CVE: CVE-2019-3878
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
mod_auth_mellon_project / mod_auth_mellon	-	0.14.2
fedoraproject / fedora	29	29.x
fedoraproject / fedora	30	30.x
redhat / enterprise_linux_desktop	7.0	7.0.x
redhat / enterprise_linux_workstation	7.0	7.0.x
redhat / enterprise_linux	7.0	7.0.x
redhat / enterprise_linux_server	7.0	7.0.x
redhat / enterprise_linux_server_tus	7.6	7.6.x
redhat / enterprise_linux_server_eus	7.6	7.6.x
redhat / enterprise_linux_server_aus	7.6	7.6.x
canonical / ubuntu_linux	18.04	18.04.x
canonical / ubuntu_linux	18.10	18.10.x

Vulnerability Database

300,926

CVE-2019-3878

Deep Security Visibility Without the Complexity