The vulnerability in client-certificate-auth allows an attacker to trigger an insecure redirect by supplying a malicious Host header in an HTTP request. The application blindly redirects to HTTPS using the Host value without validation, permitting users to be sent to arbitrary domains controlled by the attacker. This can facilitate phishing, credential theft, or other social‑engineering attacks. The weakness is identified as CWE‑601, an open redirect flaw.

The middleware client-certificate-auth from vendor tgies is affected in versions 0.2.1 and 0.3.0. Any deployment of these two releases that employs the automatic HTTP‑to‑HTTPS redirect is vulnerable.

With a CVSS score of 6.1 the vulnerability is considered medium severity. The EPSS score is below 1 %, indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector is remote and requires only a crafted HTTP request to the host performing the redirect. No active exploitation has been publicly reported, but upgrade to v1.0.0 removes the flaw.