Skip to content
OpenAdvisories

Package · npm

express-openid-connect

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2022-24794

    Open Redirect in express-openid-connect

    Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when th…

    auth0 express-openid-connect express-openid-connect npm
  • Medium 4.6
    CVE-2021-41246

    Session fixation in express-openid-connect

    Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application…

    auth0 express-openid-connect express-openid-connect npm