CVE-2026-25651 | BDVDB-2026-314246 Detail

Description#

client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-02-06Record published in the CVE List.
2. Version 22026-02-09Most recent update recorded in the CVE List.