The vulnerability identified as CVE-2026-25651 affects the tgies client-certificate-auth middleware for Node.js, specifically versions from 0.2.1 up to but not including 1.0.0. This middleware is designed to implement client SSL certificate authentication and authorization. The core issue is an open redirect vulnerability (CWE-601) caused by the middleware's unconditional redirection of HTTP requests to HTTPS using the Host header without validation. Since the Host header can be manipulated by an attacker, this allows redirection to arbitrary external domains. Such open redirects can be exploited in phishing campaigns to lure users to malicious sites that appear trustworthy due to the initial domain context. The vulnerability does not require authentication but does require user interaction to follow the redirect. The CVSS 3.1 base score is 6.1, reflecting medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability. No known exploits are currently reported in the wild. The issue is resolved in version 1.0.0 of the middleware. Organizations using affected versions should prioritize upgrading and implement validation of Host headers to prevent exploitation.

For European organizations, this vulnerability poses a moderate risk primarily through social engineering and phishing attacks that exploit the open redirect to redirect users to malicious sites. This can lead to credential theft, session hijacking, or malware delivery, impacting confidentiality and integrity of sensitive data. Organizations relying on client-certificate-auth middleware for secure authentication may see their trust model undermined if users are redirected to attacker-controlled domains. The vulnerability does not directly affect system availability but can facilitate broader attacks. Sectors such as finance, healthcare, and government, which often use client certificate authentication for secure access, are particularly at risk. The medium severity suggests a need for timely remediation to prevent exploitation, especially given the widespread use of Node.js in European web applications and services.

1. Upgrade the tgies client-certificate-auth middleware to version 1.0.0 or later where the vulnerability is fixed. 2. Implement strict validation of the Host header in HTTP requests to ensure redirects only occur to trusted domains. 3. Use allowlists for acceptable redirect targets and reject or sanitize any unrecognized Host header values. 4. Employ Content Security Policy (CSP) headers to restrict navigation and framing to trusted domains. 5. Educate users about the risks of following unexpected redirects and encourage verification of URLs before interaction. 6. Monitor web server logs for suspicious redirect patterns or unusual Host header values. 7. Consider additional layers of authentication and anomaly detection around client certificate authentication flows to detect potential misuse.