CVE-2021-41246: Session Fixation

December 9, 2021 (updated December 14, 2021)

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. It does not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities.

References

github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f
github.com/auth0/express-openid-connect/releases/tag/v2.5.2
github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9
nvd.nist.gov/vuln/detail/CVE-2021-41246

Code Behaviors & Features

Detect and mitigate CVE-2021-41246 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →