What is the CVSS score of CVE-2026-25651?

CVE-2026-25651 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of TLS are affected by CVE-2026-25651?

Organizations using client-certificate-auth should be aware of moderate risk from CVE-2026-25651 rated CVSS 6.1. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25651?

Yes, a public proof-of-concept exploit is available for CVE-2026-25651. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25651?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

TLS CVE-2026-25651

MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-02-06 security-advisories@github.com

GHSA-m4w9-gch5-c2g4

TLS Node.js Open Redirect Client Certificate Auth

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 24, 2026 - 21:00 vuln.today

Public exploit code

CVE Published

Feb 06, 2026 - 19:16 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.

AnalysisAI

Client-certificate-auth middleware for Node.js versions 0.2.1 and 0.3.0 fails to validate the Host header when redirecting HTTP requests to HTTPS, enabling attackers to craft malicious redirects that direct users to arbitrary domains. Public exploit code exists for this open redirect vulnerability, and no patch is currently available for affected versions.

Technical ContextAI

Classified as CWE-601 (URL Redirection to Untrusted Site (Open Redirect)). Affects Client-Certificate-Auth. client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.

RemediationAI

Fixed in version 1.0.0.. Restrict network access to the affected service where possible.

More in TLS

View all

CVE-2026-27180 CRITICAL Emergency POC

9.8 Feb 18

MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromis

CVE-2026-27944 CRITICAL Act Now POC

9.8 Mar 05

Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.

CVE-2026-27590 CRITICAL Act Now POC

9.8 Feb 24

FastCGI path splitting vulnerability in Caddy before 2.11.1 allows request smuggling or path confusion when proxying to

CVE-2026-27586 CRITICAL Act Now POC

9.1 Feb 24

TLS error swallowing in Caddy web server before 2.11.1 allows bypassing client certificate authentication. Errors in Cli

CVE-2026-27588 CRITICAL Act Now POC

9.1 Feb 24

Host header case sensitivity bypass in Caddy before 2.11.1. Virtual host routing can be bypassed by using alternate casi

CVE-2026-27587 CRITICAL Act Now POC

9.1 Feb 24

Case sensitivity bypass in Caddy web server path matching before 2.11.1. HTTP path matchers can be bypassed using altern

CVE-2026-25160 CRITICAL Act Now POC

9.1 Feb 04

Alist file manager has an improper certificate validation vulnerability allowing MITM attacks that could compromise file

CVE-2026-30851 HIGH This Week POC

8.1 Mar 07

Caddy versions 2.10.0 through 2.11.1 fail to strip client-supplied headers in the forward_auth copy_headers directive, e

CVE-2022-40620 HIGH This Week POC

7.7 Jan 28

FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS ce

CVE-2026-30852 HIGH This Week POC

7.5 Mar 07

Caddy versions 2.7.5 through 2.11.1 contain a template injection vulnerability in the vars_regexp matcher that allows re

CVE-2026-25961 HIGH This Week POC

7.5 Feb 09

SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers

CVE-2025-68133 HIGH This Week POC

7.4 Jan 21

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

CVE-2026-25651 vulnerability details – vuln.today

Back

TLS CVE-2026-25651

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in TLS

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

Share

External POC / Exploit Code