{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "client-certificate-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.1"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25651"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-06T18:54:33Z",
    "nvd_published_at": "2026-02-06T19:16:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nVersions 0.2.1 and 0.3.0 of `client-certificate-auth` contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated `Host` header, allowing an attacker to redirect users to arbitrary domains.\n\n### Vulnerable Code\n\n```javascript\n// lib/clientCertificateAuth.js (versions 0.2.1, 0.3.0)\nif (!req.secure \u0026\u0026 req.header(\u0027x-forwarded-proto\u0027) != \u0027https\u0027) {\n  return res.redirect(\u0027https://\u0027 + req.header(\u0027host\u0027) + req.url);\n}\n```\n\n### Attack Scenario\n\n1. Attacker crafts a link: `http://vulnerable-app.example.com/login`\n2. When victim clicks, attacker intercepts and injects header: `Host: attacker.com`\n3. Server responds: `302 Found \u2192 https://attacker.com/login`\n4. Victim is redirected to attacker-controlled site\n\n### Impact\n\n- **Phishing**: Attackers can use trusted domain links to redirect victims to credential-harvesting pages\n- **OAuth/SSO Token Theft**: In authentication flows, authorization codes or tokens may leak via redirect\n- **Referer Leakage**: Sensitive URL parameters may be exposed to attacker domains via the Referer header\n- **Cache Poisoning**: In deployments with shared caches, malicious redirects may be cached and served to other users\n\n### Exploitability\n\nExploitation requires that HTTP traffic reaches the Node.js application without TLS termination setting `x-forwarded-proto: https`. This condition is uncommon in production deployments behind modern reverse proxies or load balancers, which limits real-world exploitability.\n\n### Fix\n\nThe vulnerable redirect behavior has been completely removed in version 1.0.0.\n\n```bash\nnpm install client-certificate-auth@^1.0.0\n```\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n1. Block HTTP traffic at the network/load balancer level\n2. Ensure your reverse proxy always sets `x-forwarded-proto: https`\n3. Add middleware before `clientCertificateAuth` to validate the `Host` header against an allowlist\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n- [Fix Commit](https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52)",
  "id": "GHSA-m4w9-gch5-c2g4",
  "modified": "2026-02-06T21:43:18Z",
  "published": "2026-02-06T18:54:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25651"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tgies/client-certificate-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect"
}