| Package | Affected versions | Patched versions |
|---|---|---|
| express openid connect | < 2.7.2 | 2.7.2 |
| express-openid-connect | < 2.7.2 | 2.7.2 |
Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route.
If all routes under example.com are protected with the requiresAuth middleware, a visit to http://example.com//google.com will be redirected to google.com after login because the original url reported by the Express framework is not properly sanitised.
You are affected by this vulnerability if you are using the requiresAuth middleware on a catch all route or the default authRequired option and express-openid-connect version <=2.7.1.
Upgrade to version >=2.7.2
The fix provided in the patch will not affect your users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free