CVE-2021-41246

low-risk
Published 2021-12-09

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

Do I need to act?

-
0.38% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.6/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Express Openid Connect

Affected Vendors

Auth0

References (6)

Patch https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e1...
Release Notes https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2
Third Party Advisory https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qx...
Patch https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e1...
Release Notes https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2
Third Party Advisory https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qx...
25
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal