156 matches found
OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
Impact A configuration-dependent authentication bypass exists in OAuth2 Proxy. Deployments are affected when all of the following are true: - OAuth2 Proxy is used with an authrequest-style integration for example, nginx authrequest - --ping-user-agent is set or --gcp-healthchecks is enabled In...
CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an authrequest-style integration such as nginx authrequest and either...
CVE-2026-34457
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an authrequest-style integration such as nginx authrequest and either...
CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an authrequest-style integration such as nginx authrequest and either...
CVE-2026-34457
CVE-2026-34457 affects OAuth2 Proxy prior to 7.15.2. In deployments using an auth_request-style integration (e.g., nginx auth_request) with either --ping-user-agent or --gcp-healthchecks enabled, any request bearing the configured health-check User-Agent is treated as authenticated, bypassing log...
CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an authrequest-style integration such as nginx authrequest and either...
CVE-2026-34454
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be...
CVE-2026-34454 OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be...
CVE-2026-34454
OAuth2 Proxy (oauth2-proxy) has a regression introduced in 7.11.0 where the session cookie is not cleared when rendering the sign-in page. This can allow a remaining authenticated session on the browser, particularly for logout flows that rely on the sign-in page. The issue is fixed in 7.15.2. De...
CVE-2026-34454 OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be...
OAuth2 Proxy 代码问题漏洞
OAuth2 Proxy is a product developed by OAuth2 Proxy organization that can provide a reverse proxy for authentication with Google, Github, or other providers. Versions of OAuth2 Proxy from 7.11.0 to 7.15.2 had code-related vulnerabilities. This vulnerability stemmed from a regression issue that...
OAuth2 Proxy 安全漏洞
OAuth2 Proxy is a reverse proxy that can provide authentication for interactions with Google, Github, or other providers. Versions of OAuth2 Proxy prior to 7.15.2 contained a security vulnerability. This vulnerability stemmed from a configuration-related authentication bypass, which could allow...
PT-2026-32954
Name of the Vulnerable Software and Affected Versions OAuth2 Proxy versions 7.11.0 through 7.15.1 Description A regression prevents the reverse proxy from clearing the session cookie when rendering the sign-in page. In deployments relying on the sign-in page for the logout flow, the browser sessi...
GHSA-RV83-G57W-FR8J vulnerabilities
Vulnerabilities for packages: mockgen, sftpgo-plugin-pubsub, yunikorn-web, grafana-pyroscope, helm-docs, sbom-convert, kyverno-policy-reporter-ui, terragrunt, falco-no-driver, coredns, authservice, nri-mongodb, kyverno, knative-client, crossplane-provider-aws-sns, kuberlr, kratos, cloudprober,...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: sftpgo-plugin-pubsub, yunikorn-web, grafana-pyroscope, helm-docs, sbom-convert, kyverno-policy-reporter-ui, terragrunt, falco-no-driver, coredns, authservice, nri-mongodb, kyverno, knative-client, crossplane-provider-aws-sns, kuberlr, cloudprober, cluster-autoscaler,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: azuredisk-csi, crossplane-provider-aws-cloudformation, sftpgo-plugin-pubsub, flux-image-reflector-controller, tflint, zarf, external-secrets-operator, cluster-api-gcp-controller, knative-operator, grafana-pyroscope, thanos, pulumi, crossplane-provider-aws-firehose,...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: azuredisk-csi, crossplane-provider-aws-cloudformation, sftpgo-plugin-pubsub, flux-image-reflector-controller, tflint, zarf, external-secrets-operator, cluster-api-gcp-controller, knative-operator, grafana-pyroscope, thanos, pulumi, crossplane-provider-aws-firehose,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: sftpgo-plugin-pubsub, yunikorn-web, grafana-pyroscope, helm-docs, sbom-convert, kyverno-policy-reporter-ui, terragrunt, falco-no-driver, coredns, authservice, nri-mongodb, kyverno, knative-client, crossplane-provider-aws-sns, kuberlr, cloudprober, cluster-autoscaler,...
FreeBSD : oauth2-proxy -- multiple vulnerabilities (10319b08-f050-4beb-95e3-fe025cdafd25)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 10319b08-f050-4beb-95e3-fe025cdafd25 advisory. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields...
FreeBSD : oauth2-proxy -- multiple vulnerabilities (fb561db9-0fc1-4d92-81a2-ee01839c9119)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fb561db9-0fc1-4d92-81a2-ee01839c9119 advisory. Within HostnameError.Error, when constructing an error string, there is no limit to the number...