6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25651

CVE-2026-25651: client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect

client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25651

CVE-2026-25651:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
client-certificate-auth	npm	>= 0.2.1, < 1.0.0	1.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis was based on the provided fix commit 8fc995e953db483495be46862965e50fe9e1cc52. The patch explicitly removes the code responsible for the open redirect from two files: lib/clientCertificateAuth.js (ESM) and lib/clientCertificateAuth.cjs (CommonJS). The removed code block unconditionally used the req.headers['host'] value to construct a redirect URL when performing an HTTP-to-HTTPS redirect. This is a classic open redirect vulnerability (CWE-601). The main exported function, clientCertificateAuth, returns the middleware containing this vulnerable logic. Therefore, clientCertificateAuth is identified as the vulnerable function, as it is responsible for creating and returning the insecure middleware. The fix completely removes the redirectInsecure option and the associated redirect logic, mitigating the vulnerability.

Vulnerable functions

clientCertificateAuth

lib/clientCertificateAuth.js

The function `clientCertificateAuth` returns an Express middleware. In vulnerable versions, if the `redirectInsecure` option was set to true, this middleware would check if the request was insecure. If so, it would construct a redirect URL using the unvalidated `Host` header from the incoming request (`req.headers['host']`). This allows an attacker to control the redirection target, leading to an open redirect vulnerability.

clientCertificateAuth

lib/clientCertificateAuth.cjs

This is the CommonJS version of the same vulnerable function. It returns an Express middleware that, when the `redirectInsecure` option was enabled, used the unvalidated `Host` header to perform an HTTP-to-HTTPS redirect, creating an open redirect vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.