What’s Vulnerable › Vulnerabilities

CVE-2021-41246: Session fixation in express-openid-connect

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-09 · updated 2026-06-17
• Weakness: CWE-384

Description

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

Affected products

• auth0 express-openid-connect: from 2.3.0 before 2.5.2 — fixed in 2.5.2

How to fix

Upgrade to a fixed version: auth0 express-openid-connect 2.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f
• https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2
• https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9
• https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f
• https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2
• https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9

Get alerted when CVE-2021-41246 or the next vulnerability affects your stack