CVE-2021-41246 — Session fixation in express-openid-connect
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the sessi…
Published: 2021-12-09 · CVSS: 4.6 · CVSS 3.1
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7