Executive brief
client-certificate-auth is a Node.js middleware package used to enforce client certificate authentication in web applications. A vulnerability in versions 0.2.1 through 0.3.0 allows attackers to perform open redirects by injecting a malicious Host header, potentially redirecting users to attacker-controlled phishing pages and enabling theft of OAuth tokens or sensitive credentials during authentication flows.
Technical details
The vulnerability is an open redirect (CWE-601) in the HTTP-to-HTTPS redirect logic of client-certificate-auth. The vulnerable code unconditionally constructs a redirect URL using the unvalidated Host header from incoming HTTP requests: `https://" + req.header('host') + req.url`. An attacker can inject a malicious Host header (e.g., attacker.com) to cause the middleware to redirect victims to an arbitrary domain. Attack vector is network-based and requires user interaction (victim must click a crafted link), with the attacker also needing to intercept or inject the Host header before the request reaches the application. Real-world exploitability is limited by the requirement that HTTP traffic reach the Node.js application directly without a reverse proxy setting x-forwarded-proto: https, which is uncommon in modern production deployments. The vulnerability is fixed in version 1.0.0, which removes the vulnerable redirect behavior entirely.
Affected products
- tgies client-certificate-auth 0.2.1 through 0.3.0
Timeline
- 2026-02-06: disclosed
- 2026-02-06: patched: Fixed in version 1.0.0