CVE-2021-41246

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
auth0	express-openid-connect	>= 2.3.0, < 2.5.2

References

https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430fPatch, Third Party Advisory
https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2Release Notes, Third Party Advisory
https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9Third Party Advisory
https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430fPatch, Third Party Advisory
https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2Release Notes, Third Party Advisory
https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9Third Party Advisory

Timeline

Published: Dec 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412477.5JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in t CVE-2021-412484.7GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of gr CVE-2021-412494.7GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than gra CVE-2021-41258.1It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as CVE-2021-412504.3Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise t CVE-2021-412515.9@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This CVE-2021-412525.4Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other fie CVE-2021-412538.1Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in CVE-2021-412548.8kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined CVE-2021-412567.1nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app CVE-2021-412585.4Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is t CVE-2021-41266.5When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added