@okta/oidc-middlewareOpen Redirect vulnerability

Description

An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

Affected products and versions Okta OIDC Middleware prior to version 5.0.0.

Resolution The vulnerability is fixed in OIDC Middleware 5.0.0.

Recommendation

Update the @okta/oidc-middleware package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-58h4-9m7m-j9m4
• CVE-2022-3145
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• DOMPurify Open Redirect vulnerability - CVE-2019-25155
• ReDoS Vulnerability in ua-parser-js version - CVE-2022-25927
• matrix-js-sdk Prototype Pollution vulnerability - CVE-2022-36059
• Open Redirect in urijs - CVE-2022-0868

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@okta/oidc-middleware