CVE-2026-25651

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25651", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-04T05:15:41.792Z", "datePublished": "2026-02-06T18:50:26.046Z", "dateUpdated": "2026-02-09T15:28:48.992Z"}, "containers": {"cna": {"title": "client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4"}, {"name": "https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0"}], "affected": [{"vendor": "tgies", "product": "client-certificate-auth", "versions": [{"version": ">= 0.2.1, < 1.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T18:50:26.046Z"}, "descriptions": [{"lang": "en", "value": "client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0."}], "source": {"advisory": "GHSA-m4w9-gch5-c2g4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:19:32.286725Z", "id": "CVE-2026-25651", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:28:48.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25651", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:19:32.286725Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:19:32.970Z"}}], "cna": {"title": "client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect", "source": {"advisory": "GHSA-m4w9-gch5-c2g4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "tgies", "product": "client-certificate-auth", "versions": [{"status": "affected", "version": ">= 0.2.1, < 1.0.0"}]}], "references": [{"url": "https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4", "name": "https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0", "name": "https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T18:50:26.046Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25651", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:28:48.992Z", "dateReserved": "2026-02-04T05:15:41.792Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T18:50:26.046Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "client-certificate-auth", "vendor": "tgies", "versions": [{"status": "affected", "version": ">= 0.2.1, < 1.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tgies:client-certificate-auth:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "12D5AAD7-AA91-4059-8A66-7A6751B3B140", "versionEndExcluding": "1.0.0", "versionStartIncluding": "0.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0."}, {"lang": "es", "value": "client-certificate-auth es un middleware para Node.js que implementa autenticaci\u00f3n/autorizaci\u00f3n de certificados SSL de cliente. Las versiones 0.2.1 y 0.3.0 de client-certificate-auth contienen una vulnerabilidad de redirecci\u00f3n abierta. El middleware redirige incondicionalmente las solicitudes HTTP a HTTPS utilizando el encabezado Host no validado, permitiendo a un atacante redirigir a los usuarios a dominios arbitrarios. Esta vulnerabilidad est\u00e1 corregida en 1.0.0."}], "id": "CVE-2026-25651", "lastModified": "2026-06-17T10:25:01.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25651", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:19:32.286725Z", "version": "2.0.3"}}]}, "published": "2026-02-06T19:16:09.897", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:34:13.789855+00:00", "value": {"mitigation_remediation": ["Upgrade client\u2011certificate\u2011auth to version 1.0.0 or later.", "If an upgrade is not immediately possible, configure the middleware or the surrounding application to validate the Host header against an allow list before performing the redirect.", "Ensure that any redirect logic uses trusted, internal domain names rather than trusting client\u2011supplied headers to prevent open redirect behavior."], "summary": {"action": "Apply Patch", "impact": "Open Redirect"}, "threat_synthesis": {"affected_systems": "The middleware client-certificate-auth from vendor tgies is affected in versions 0.2.1 and 0.3.0. Any deployment of these two releases that employs the automatic HTTP\u2011to\u2011HTTPS redirect is vulnerable.", "description_and_impact": "The vulnerability in client-certificate-auth allows an attacker to trigger an insecure redirect by supplying a malicious Host header in an HTTP request. The application blindly redirects to HTTPS using the Host value without validation, permitting users to be sent to arbitrary domains controlled by the attacker. This can facilitate phishing, credential theft, or other social\u2011engineering attacks. The weakness is identified as CWE\u2011601, an open redirect flaw.", "risk_and_exploitability": "With a CVSS score of 6.1 the vulnerability is considered medium severity. The EPSS score is below 1\u202f%, indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector is remote and requires only a crafted HTTP request to the host performing the redirect. No active exploitation has been publicly reported, but upgrade to v1.0.0 removes the flaw."}}}}, "created": "2026-02-09T10:50:12.946878+00:00", "updated": "2026-04-17T22:45:29.919343+00:00", "vendors": ["tgies", "tgies$PRODUCT$client-certificate-auth"]}