Auth0 Express Openid Connect
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Auth0 Express Openid Connect.
By the Year
In 2026 there have been 0 vulnerabilities in Auth0 Express Openid Connect. Express Openid Connect did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 6.10 |
| 2021 | 1 | 8.80 |
It may take a day or so for new Express Openid Connect vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Auth0 Express Openid Connect Security Vulnerabilities
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect
CVE-2022-24794
6.1 - Medium
- March 31, 2022
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
Open Redirect
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect
CVE-2021-41246
8.8 - High
- December 09, 2021
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.
Session Fixation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Auth0 Express Openid Connect or by Auth0? Click the Watch button to subscribe.
