TI-2022-08607 Aliases CVE-2022-24794 GHSA-7p99-3798-f85c

Open Redirect in express-openid-connect

LOW 34CWE-601Published 2022-03-31 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00738 54th percentileScored 2026-11-07

Fix Fixed express-openid-connect (auth0): 2.7.2express-openid-connect (npm): 2.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	express-openid-connect	before 2.7.2	2.7.2	Patch available	CNA
—	express-openid-connect (npm)	before 2.7.2	2.7.2	Patch available	GHSA-7p99-3798-f85c

express-openid-connect Vendorauth0 Affected before 2.7.2 Fixed in 2.7.2 Patch available CNA
express-openid-connect (npm) Vendor— Affected before 2.7.2 Fixed in 2.7.2 Patch available GHSA-7p99-3798-f85c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:express_openid_connect::::::node.js::*	before 2.7.2	Vulnerable	auth0

cpe:2.3:a:auth0:express_openid_connect:*:*:*:*:*:node.js:*:* Versions before 2.7.2 Vulnerable ·auth0

Remediation

Fix · CNA express-openid-connect (auth0) Fixed in 2.7.2
Fix · GHSA-7p99-3798-f85c express-openid-connect (npm) Fixed in 2.7.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24794
2026-10-03 Alias added: GHSA-7p99-3798-f85c

References

Patch 1

https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad

Advisory 2

Other 1

https://github.com/auth0/express-openid-connect

TI-2021-18081 Session fixation in express-openid-connect CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences