https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:54:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-31604 EUVD-2026-31604 https://cve.radiocsirt.org/vuln/euvd-2026-31604 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41246 <p>Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.</p> <p>Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-41246 https://cve.radiocsirt.org/vuln/ghsa-7rg2-qxmf-hhx9 <p><strong>Affected:</strong> npm: express-openid-connect</p> <p>### Overview</p> <p>Versions `2.3.0` up to and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities.</p> <p>### Am I affected? You are affected by this vulnerability if you are using `express-openid-connect` version `2.3.0` up to and including `2.5.1` and use a custom session store.</p> <p>### How to fix that? Upgrade to version `&gt;= 2.5.2`.</p> <p>### Will this update impact my users? The fix provided in patch will not affect your users.</p> <p><strong>Affected:</strong> npm: express-openid-connect</p> <p>### Overview</p> <p>Versions `2.3.0` up to and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities.</p> <p>### Am I affected? You are affected by this vulnerability if you are using `express-openid-connect` version `2.3.0` up to and including `2.5.1` and use a custom session store.</p> <p>### How to fix that? Upgrade to version `&gt;= 2.5.2`.</p> <p>### Will this update impact my users? The fix provided in patch will not affect your users.</p> https://cve.radiocsirt.org/vuln/ghsa-7rg2-qxmf-hhx9 https://cve.radiocsirt.org/vuln/gsd-2021-41246 gsd-2021-41246 https://cve.radiocsirt.org/vuln/gsd-2021-41246