{"cve":"CVE-2022-24794","nvd":{"published":"2022-03-31T23:15:08.127","modified":"2026-06-17T04:32:32.040","status":"Modified","description":"Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-601"],"references":["https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad","https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c","https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad","https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c"],"products":["auth0:express_openid_connect"],"source":"nvd","synced_at":"2026-10-19T21:29:06.454770966+00:00"},"epss":{"cve":"CVE-2022-24794","score":0.00738,"percentile":0.54558,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7p99-3798-f85c","url":"https://osv.dev/vulnerability/GHSA-7p99-3798-f85c","summary":"URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect","modified":"2023-11-08T04:08:36.775113Z","packages":[{"ecosystem":"npm","name":"express-openid-connect","purl":"pkg:npm/express-openid-connect","ranges":["<2.7.2"],"fixed":["2.7.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}