CVE-2022-24794 is a high-severity (CVSS 7.5) Open Redirect vulnerability in express-openid-connect. A fix is available for express-openid-connect — see the affected versions and patch details below.
Open Redirect in express-openid-connect
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-24794.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
express-openid-connectnpmDescription
Impact
Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route.
If all routes under example.com are protected with the requiresAuth middleware, a visit to http://example.com//google.com will be redirected to google.com after login because the original url reported by the Express framework is not properly sanitised.
Am I affected?
You are affected by this vulnerability if you are using the requiresAuth middleware on a catch all route or the default authRequired option and express-openid-connect version <=2.7.1.
How to fix that?
Upgrade to version >=2.7.2
Will this update impact my users?
The fix provided in the patch will not affect your users.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | express-openid-connect | all versions | 2.7.2npm install express-openid-connect@2.7.2 |
Affected Products
express openid connectauth0Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for express-openid-connect, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update express-openid-connect to 2.7.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-24794 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is CVE-2022-24794 in your dependencies?
Find it across npm, including transitive dependencies.