@okta/oidc-middlewareOpen Redirect vulnerability

Description

An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

Affected products and versions Okta OIDC Middleware prior to version 5.0.0.

Resolution The vulnerability is fixed in OIDC Middleware 5.0.0.

Recommendation

Update the @okta/oidc-middleware package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-58h4-9m7m-j9m4
• CVE-2022-3145
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• mongosh vulnerable to local privilege escalation - CVE-2025-1756
• Elliptic's EDDSA missing signature length check - CVE-2024-42459
• Nuxt Devtools has a Path Traversal: '../filedir - CVE-2024-23657
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

@okta/oidc-middleware