CVE-2021-41246

🗓️ 09 Dec 2021 15:55:10Reported by GitHub_MType

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-41246	9 Dec 202118:23	–	circl
CNNVD	Auth0 Express OpenId Connect 授权问题漏洞	9 Dec 202100:00	–	cnnvd
Cvelist	CVE-2021-41246 Session fixation in express-openid-connect	9 Dec 202115:55	–	cvelist
EUVD	EUVD-2021-2474	7 Oct 202500:30	–	euvd
Github Security Blog	Session fixation in express-openid-connect	9 Dec 202119:08	–	github
NVD	CVE-2021-41246	9 Dec 202116:15	–	nvd
OSV	GHSA-7RG2-QXMF-HHX9 Session fixation in express-openid-connect	9 Dec 202119:08	–	osv
Prion	Session fixation	9 Dec 202116:15	–	prion
RedhatCVE	CVE-2021-41246	9 Jan 202609:21	–	redhatcve
Veracode	Session Fixation	10 Dec 202107:57	–	veracode

NVD

Vulners

Node

auth0 express_openid_connectRange2.3.0–2.5.2node.js

[
  {
    "product": "express-openid-connect",
    "vendor": "auth0",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.3.0, < 2.5.2"
      }
    ]
  }
]

Source	Link
github	www.github.com/auth0/express-openid-connect/releases/tag/v2.5.2
github	www.github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9
github	www.github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f

21 Nov 2024 06:25Current

6.5Medium risk

Vulners AI Score6.5

CVSS 26.8

CVSS 3.14.6 - 8.8

EPSS0.00381

CWE-384