TI-2021-18081 Aliases CVE-2021-41246 GHSA-7rg2-qxmf-hhx9

Session fixation in express-openid-connect

MEDIUM 40CWE-384Published 2021-12-09 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-384.

Summary

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

Why it matters now

EPSS 0.00924 60th percentileScored 2026-11-07

Fix Fixed express-openid-connect (auth0): 2.5.2express-openid-connect (npm): 2.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	express-openid-connect	2.3.0 to before 2.5.2	2.5.2	Patch available	CNA
—	express-openid-connect (npm)	2.3.0 to before 2.5.2	2.5.2	Patch available	GHSA-7rg2-qxmf-hhx9

express-openid-connect Vendorauth0 Affected 2.3.0 to before 2.5.2 Fixed in 2.5.2 Patch available CNA
express-openid-connect (npm) Vendor— Affected 2.3.0 to before 2.5.2 Fixed in 2.5.2 Patch available GHSA-7rg2-qxmf-hhx9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:express_openid_connect::::::node.js::*	2.3.0 to before 2.5.2	Vulnerable	auth0

cpe:2.3:a:auth0:express_openid_connect:*:*:*:*:*:node.js:*:* Versions 2.3.0 to before 2.5.2 Vulnerable ·auth0

Remediation

Fix · CNA express-openid-connect (auth0) Fixed in 2.5.2
Fix · GHSA-7rg2-qxmf-hhx9 express-openid-connect (npm) Fixed in 2.5.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41246
2026-10-03 Alias added: GHSA-7rg2-qxmf-hhx9

References

Patch 1

https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f

Advisory 3

Other 1

https://github.com/auth0/express-openid-connect

TI-2022-08607 Open Redirect in express-openid-connect CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences