@okta/oidc-middlewareOpen Redirect vulnerability

Description

An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

Affected products and versions Okta OIDC Middleware prior to version 5.0.0.

Resolution The vulnerability is fixed in OIDC Middleware 5.0.0.

Recommendation

Update the @okta/oidc-middleware package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.0.0
• Patched version(s): 5.0.0

References

• GHSA-58h4-9m7m-j9m4
• CVE-2022-3145
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Open Redirect in urijs - CVE-2022-0868
• libp2p DoS vulnerability from lack of resource management - CVE-2022-23487
• Denial of Service (DoS) vulnerability in RSSHub - CVE-2022-31110
• steal Inefficient Regular Expression Complexity vulnerability via string variable - CVE-2022-37259

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@okta/oidc-middleware