CVE-2026-25651CWE-601

client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect

Medium · published February 6, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-02-06T18:50Z
EPSS history
Timeline
  • 06 FEB 18:50Z
    client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect
    cvelistv5