Medium, CVSS 6.1npmAmendedPublished
client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect
CVE-2026-25651 · GHSA-m4w9-gch5-c2g4
- Affected
- npm client-certificate-auth >= 0.2.1, < 1.0.0
- Fixed in
- 1.0.0· Vendor fix available
- Issue
- Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. Vulnerable Code Attack Scenario 1. Attacker crafts a link: http://vulnerable-app.example.com/login 2. When victim clicks, attacker intercepts and injects header: Host: attacker.com 3. Server responds: 302 Found → https://attacker.com/login 4. Victim is redirected to attacker-controlled site Impact - Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages - OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect - Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header - Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users Exploitability…
Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.