CVE-2017-1000069

The CVE-2017-1000069 entry describes a Cross-Site Request Forgery (CSRF) vulnerability in Bitly oauth2_proxy version 2.1 during the authentication flow. Connected documents corroborate CSRF as the vulnerability class affecting Bitly oauth2_proxy 2.1. The primary impact is reflected in the CVSS me...

CVE-2017-1000070

CVE-2017-1000070 concerns the Bitly oauth2_proxy showing an open redirect vulnerability in versions up to 2.1 during the start and end of the 2-legged OAuth flow. The root cause cited is improper input validation violating RFC-6819, allowing an attacker to redirect users to arbitrary sites. The c...

CVE-2017-1000069

CSRF in Bitly oauth2proxy 2.1 during authentication flow...

CVE-2017-1000070

The Bitly oauth2proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819...

Timing Attack

github.com/bitly/oauth2proxy is vulnerable to timing attacks. This vulnerability is caused because the cookies are not compared in constant time, allowing malicious users to guess the valid cookies based on the time that a comparison takes...