CVE-2021-41246— Session fixation in express-openid-connect
Quick assessment
Affected
auth0 express-openid-connect
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Auth0 Express OpenId Connect是美国Auth0公司的一个开源组件。用于保护 OpenID Connect Web 应用程序的 Express.js 中间件。 Auth0 Express OpenID Connect 存在授权问题漏洞，该漏洞源于不会在用户登录时重新生成会话 ID 和会话 cookie。这种行为使应用程序面临各种会话固定漏洞。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-41246
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Session fixation in express-openid-connect
Source: CVE Program / CVE List V5
Vulnerability Description
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5
Vulnerability Title
Auth0 Express OpenId Connect 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Auth0 Express OpenId Connect是美国Auth0公司的一个开源组件。用于保护 OpenID Connect Web 应用程序的 Express.js 中间件。 Auth0 Express OpenID Connect 存在授权问题漏洞，该漏洞源于不会在用户登录时重新生成会话 ID 和会话 cookie。这种行为使应用程序面临各种会话固定漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| auth0 | express-openid-connect | >= 2.3.0, < 2.5.2 | - |
|
II. Public POCs for CVE-2021-41246
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-41246
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-41246 (1)
Vendor Advisories for CVE-2021-41246 (1)
Other References for CVE-2021-41246 (1)
-
https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: auth0
-
CVE-2026-50157
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter -
CVE-2026-84685
Improper Cache Isolation in auth0/react-native-auth0 SDK Web -
CVE-2026-85983
Local Privilege Escalation in Auth0 AD/LDAP Connector -
CVE-2026-85982
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector -
CVE-2026-85981
Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Conne
Same weakness: CWE-384
-
CVE-2026-107229
AsyncHttpClient: Incomplete origin checks in the default coo -
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via de -
CVE-2026-105233
kishor-23 food-waste-management-system Login Flow login.php -
CVE-2026-104469
YesWiki before 4.6.7 Session Fixation via Login in AuthContr -
CVE-2026-71302
Toptech TMS7 and TopHAT Session Fixation
V. Comments for CVE-2021-41246
No comments yet