CVE-2021-41246: Session fixation in express-openid-connect
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions 2.5.2 contains a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41246?
CVE-2021-41246 is considered a medium severity vulnerability due to its potential for session fixation attacks.
How do I fix CVE-2021-41246?
To fix CVE-2021-41246, upgrade the Auth0 Express OpenID Connect middleware to version 2.5.2 or later.
What does CVE-2021-41246 affect?
CVE-2021-41246 affects versions of Auth0 Express OpenID Connect middleware prior to 2.5.2.
What type of vulnerability is CVE-2021-41246?
CVE-2021-41246 is a session fixation vulnerability that arises from not regenerating session IDs upon user login.
Can I be exploited if I'm using an affected version listed in CVE-2021-41246?
Yes, using an affected version of the Auth0 Express OpenID Connect middleware leaves your application vulnerable to session fixation attacks.