{"id":"CVE-2026-25651","aliases":["EUVD-2026-5630","GHSA-m4w9-gch5-c2g4"],"status":"published","title":"client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect","description":"client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00183,"percentile":0.07992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2026-02-06T18:50:26Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"npm","package":"client-certificate-auth","fixed_in":["1.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"client-certificate-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.1"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"client-certificate-auth","ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.1"},{"fixed":"1.0.0"}]}]}],"products":[{"vendor":"tgies","product":"client-certificate-auth"}],"references":[{"url":"https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25651","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m4w9-gch5-c2g4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25651.json","tags":["advisory"]},{"url":"https://github.com/tgies/client-certificate-auth","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25651","title":"client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect","description":"client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.","status":"published","published":"2026-02-06T18:50:26.046Z","modified":"2026-02-09T15:28:48.992Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-5630","description":"client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.","status":"published","published":"2026-02-06T18:50:26Z","modified":"2026-02-09T15:28:48Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:42.465921Z"}],"ghsa":[{"id":"GHSA-m4w9-gch5-c2g4","title":"client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect","description":"### Summary\n\nVersions 0.2.1 and 0.3.0 of `client-certificate-auth` contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated `Host` header, allowing an attacker to redirect users to arbitrary domains.\n\n### Vulnerable Code\n\n```javascript\n// lib/clientCertificateAuth.js (versions 0.2.1, 0.3.0)\nif (!req.secure \u0026\u0026 req.header('x-forwarded-proto') != 'https') {\n  return res.redirect('https://' + req.header('host') + req.url);\n}\n```\n\n### Attack Scenario\n\n1. Attacker crafts a link: `http://vulnerable-app.example.com/login`\n2. When victim clicks, attacker intercepts and injects header: `Host: attacker.com`\n3. Server responds: `302 Found → https://attacker.com/login`\n4. Victim is redirected to attacker-controlled site\n\n### Impact\n\n- **Phishing**: Attackers can use trusted domain links to redirect victims to credential-harvesting pages\n- **OAuth/SSO Token Theft**: In authentication flows, authorization codes or tokens may leak via redirect\n- **Referer Leakage**: Sensitive URL parameters may be exposed to attacker domains via the Referer header\n- **Cache Poisoning**: In deployments with shared caches, malicious redirects may be cached and served to other users\n\n### Exploitability\n\nExploitation requires that HTTP traffic reaches the Node.js application without TLS termination setting `x-forwarded-proto: https`. This condition is uncommon in production deployments behind modern reverse proxies or load balancers, which limits real-world exploitability.\n\n### Fix\n\nThe vulnerable redirect behavior has been completely removed in version 1.0.0.\n\n```bash\nnpm install client-certificate-auth@^1.0.0\n```\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n1. Block HTTP traffic at the network/load balancer level\n2. Ensure your reverse proxy always sets `x-forwarded-proto: https`\n3. Add middleware before `clientCertificateAuth` to validate the `Host` header against an allowlist\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n- [Fix Commit](https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52)","status":"published","published":"2026-02-06T18:54:33Z","modified":"2026-02-06T21:43:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:39:23.728882Z"}],"nvd":[{"id":"CVE-2026-25651","description":"client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.","status":"published","published":"2026-02-06T19:16:09.897Z","modified":"2026-06-17T10:25:01.167Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"CVE-2026-25651","title":"client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect","description":"client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.","status":"published","published":"2026-02-06T18:50:26.046Z","modified":"2026-10-28T02:30:59.889760156Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-m4w9-gch5-c2g4","title":"client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect","description":"### Summary\n\nVersions 0.2.1 and 0.3.0 of `client-certificate-auth` contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated `Host` header, allowing an attacker to redirect users to arbitrary domains.\n\n### Vulnerable Code\n\n```javascript\n// lib/clientCertificateAuth.js (versions 0.2.1, 0.3.0)\nif (!req.secure \u0026\u0026 req.header('x-forwarded-proto') != 'https') {\n  return res.redirect('https://' + req.header('host') + req.url);\n}\n```\n\n### Attack Scenario\n\n1. Attacker crafts a link: `http://vulnerable-app.example.com/login`\n2. When victim clicks, attacker intercepts and injects header: `Host: attacker.com`\n3. Server responds: `302 Found → https://attacker.com/login`\n4. Victim is redirected to attacker-controlled site\n\n### Impact\n\n- **Phishing**: Attackers can use trusted domain links to redirect victims to credential-harvesting pages\n- **OAuth/SSO Token Theft**: In authentication flows, authorization codes or tokens may leak via redirect\n- **Referer Leakage**: Sensitive URL parameters may be exposed to attacker domains via the Referer header\n- **Cache Poisoning**: In deployments with shared caches, malicious redirects may be cached and served to other users\n\n### Exploitability\n\nExploitation requires that HTTP traffic reaches the Node.js application without TLS termination setting `x-forwarded-proto: https`. This condition is uncommon in production deployments behind modern reverse proxies or load balancers, which limits real-world exploitability.\n\n### Fix\n\nThe vulnerable redirect behavior has been completely removed in version 1.0.0.\n\n```bash\nnpm install client-certificate-auth@^1.0.0\n```\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n1. Block HTTP traffic at the network/load balancer level\n2. Ensure your reverse proxy always sets `x-forwarded-proto: https`\n3. Add middleware before `clientCertificateAuth` to validate the `Host` header against an allowlist\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n- [Fix Commit](https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52)","status":"published","published":"2026-02-06T18:54:33Z","modified":"2026-02-06T22:22:03.562389Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:51.463834Z"}]}}