CVE-2021-41246

—

CVSS 3.1

8.8 high

EPSS

<1%p57

Published

Dec 9, 2021 (Dec 9, 2021)

Modified

Jun 17, 2026

Description

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

Vendors: auth0
Products: express openid connect
Weakness: CWE-384
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.