CVE-2021-21411

OAuth2-Proxy suffered a vulnerability where the --gitlab-group flag for GitLab-group-based authorization stopped working in v7.0.0. Regardless of the flag, authorization wasn’t restricted and an authenticated user’s groups were added to X-Forwarded-Groups upstream. A bug caused the user session’s...

OAuth2-Proxy 访问控制错误漏洞

OAuth2 Proxy is a reverse proxy that provides authentication with Google, Github or other providers. OAuth2 Proxy suffers from an access control error vulnerability that stems from the fact that none of the authorizations are restricted. No details of the vulnerability are available at this time...

PT-2021-14486 · Unknown · Oauth2 Proxy

Name of the Vulnerable Software and Affected Versions: OAuth2-Proxy versions 7.0.0 through 7.0.x Description: The --gitlab-group flag for group-based authorization in the GitLab provider stopped working, allowing any authenticated users to access applications regardless of --gitlab-group membersh...

FreeBSD : oauth2-proxy -- domain whitelist could be used as redirect (3003ba60-6cec-11eb-8815-040e3c1b8a02)

SO-AND-SO reports : In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

CVE-2021-21291

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers Google, GitHub, and others to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in...

CVE-2021-21291

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers Google, GitHub, and others to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in...

Design/Logic Flaw

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers Google, GitHub, and others to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in...

CVE-2021-21291

CVE-2021-21291: OAuth2 Proxy (open-source reverse proxy) before v7.0.0 had a vulnerability in the whitelist-domain feature where a domain matched for redirects could be broader than intended (e.g., .example.com could match example.com and badexample.com). This could allow unintended redirects. Im...

CVE-2021-21291 Subdomain checking of whitelisted domains could allow unintended redirects

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers Google, GitHub, and others to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in...

oauth2-proxy -- domain whitelist could be used as redirect

The oauth2-proxy Team reports: In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect...

OAuth2 Proxy Input Validation Error Vulnerability

OAuth2 Proxy is a reverse proxy that provides authentication with Google, Github, or other providers. A security vulnerability exists in OAuth2 Proxy that stems from allowing domains that end in a manner similar to the expected domain to be used as redirects...

CVE-2020-4037

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

CVE-2020-4037

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

Design/Logic Flaw

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

CVE-2020-4037

CVE-2020-4037 concerns OAuth2 Proxy where versions 5.1.1 and older (up to 5.9.x) allow a user-supplied redirect URL at the end of the authentication flow. The redirect target is validated by the proxy, but the issue arises from insufficiently restricted redirects, potentially enabling open redire...

CVE-2020-4037 Open Redirect in OAuth2 Proxy

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

PT-2020-17845 · Oauth2 Proxy · Oauth2 Proxy

Name of the Vulnerable Software and Affected Versions: OAuth2 Proxy versions 5.1.1 through 5.9.x Description: The issue allows users to provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This redirect URL is checked within the proxy a...

CVE-2020-11053

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

CVE-2020-11053

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

Open redirect

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...