CVE-2021-41246

    Dashboard / Vulnerabilities / CVE-2021-41246

    CVE-2021-41246

    Published: 9 Dec 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

    References: https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2, https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9, https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5566d1a941fc2a1487c242204c07e5805c4913f7
    Fixed -c2557569e62b6136b249aa6b6fce41252af7dc5c

    Affected versions

    v2.5.1
    v2.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41246 | CVE-DB