CVE-2021-41246

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

• CWE-384

• https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430fPatch, Third Party Advisory
• https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2Release Notes, Third Party Advisory
• https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9Third Party Advisory
• https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430fPatch, Third Party Advisory
• https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2Release Notes, Third Party Advisory
• https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9Third Party Advisory

Published

Dec 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4124janus-gateway is vulnerable to Improper Neutralization of In…6.1
• CVE-2021-41241Nextcloud server is a self hosted system designed to provide…4.3
• CVE-2021-41242OpenOlat is a web-basedlearning management system. A path tr…8.1
• CVE-2021-41243There is a Potential Zip Slip Vulnerability and OS Command I…8.8
• CVE-2021-41244Grafana is an open-source platform for monitoring and observ…7.2
• CVE-2021-41245Combodo iTop is a web based IT Service Management tool. In v…8.1
• CVE-2021-41247JupyterHub is an open source multi-user server for Jupyter n…7.5
• CVE-2021-41248GraphiQL is the reference implementation of this monorepo, G…4.7
• CVE-2021-41249GraphQL Playground is a GraphQL IDE for development of graph…4.7
• CVE-2021-4125It was found that the original fix for log4j CVE-2021-44228 …8.1
• CVE-2021-41250Python discord bot is the community bot for the Python Disco…4.3
• CVE-2021-41251@sap-cloud-sdk/core contains the core functionality of the S…5.9