https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T17:41:06.470616+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-31604 EUVD-2026-31604 2026-10-08T17:41:06.533036+00:00 EUVD-2026-31604 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41246 fkie_cve-2021-41246 2026-10-08T17:41:06.533078+00:00

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-7rg2-qxmf-hhx9 GHSA-7rg2-qxmf-hhx9 — Session fixation in express-openid-connect 2026-10-08T17:41:06.533113+00:00

Affected: npm: express-openid-connect

### Overview

Versions `2.3.0` up to and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities.

### Am I affected? You are affected by this vulnerability if you are using `express-openid-connect` version `2.3.0` up to and including `2.5.1` and use a custom session store.

### How to fix that? Upgrade to version `>= 2.5.2`.

### Will this update impact my users? The fix provided in patch will not affect your users.

 https://cve.radiocsirt.org/vuln/gsd-2021-41246 gsd-2021-41246 2026-10-08T17:41:06.533145+00:00 gsd-2021-41246