CVE-2022-24794 json
Open Redirect in express-openid-connect
published 2022-03-31 4 y ago modified 2026-06-17 4 mo ago also GHSA-7p99-3798-f85c , EUVD-2022-1363
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
Patch / fix
- npm express-openid-connect 2.7.2
- auth0 express_openid_connect 2.7.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | express-openid-connect | <2.7.2 |
2.7.2 |
Affected products
- auth0 express-openid-connect
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad
web, patch, third-party-advisory
-
github.com
/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-24794
advisory
-
github.com
/auth0/express-openid-connect
package
Sources
- CVE List CVE-2022-24794
- GitHub Advisory GHSA-7p99-3798-f85c
- NVD CVE-2022-24794
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.