CVE-2022-24794: Open Redirect in express-openid-connect
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to http://example.com//google.com will be redirected to google.com after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24794?
CVE-2022-24794 is classified as a high severity vulnerability due to the potential for open redirect attacks that could be exploited by malicious users.
How do I fix CVE-2022-24794?
To fix CVE-2022-24794, update the Auth0 Express OpenID Connect middleware to version 2.7.2 or later.
What type of vulnerability is CVE-2022-24794?
CVE-2022-24794 is an Open Redirect vulnerability affecting the requiresAuth middleware in the Auth0 Express OpenID Connect package.
Who is affected by CVE-2022-24794?
Users of the Auth0 Express OpenID Connect middleware version prior to 2.7.2 are affected by CVE-2022-24794.
What applications are impacted by CVE-2022-24794?
Web applications using the Auth0 Express OpenID Connect middleware with the requiresAuth implementation are impacted by CVE-2022-24794.