CVE-2017-1000070: Open Redirect in oauth2_proxy
Summary
CVE-2017-1000070: Open Redirect in oauth2_proxy. Affects github.com/bitly/oauth2_proxy versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The oauth2_proxy package, specifically version 2.1 and earlier, is a Bitly library written in Go. It provides support for the 2-legged OAuth flow. OAuth2_proxy is designed to act as a reverse proxy and authenticate requests using OAuth2 providers such as GitHub, Google, and Azure. It is commonly used to secure web applications and APIs by adding authentication and authorization capabilities. However, versions 2.1 and earlier are vulnerable to an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This vulnerability is a result of improper input validation and a violation of RFC-6819.
Vulnerability Detail
The open redirect vulnerability in oauth2_proxy can be exploited by an attacker to redirect users to malicious websites. During the 2-legged OAuth flow, the redirect_uri parameter is not properly validated, allowing an attacker to craft a malicious URL that redirects the user to a different domain. This can lead to various attacks, such as phishing, where the attacker tricks the user into visiting a malicious website that appears legitimate. The impact of this vulnerability depends on the attacker's intentions and the user's actions, but it can potentially result in the disclosure of sensitive information or the execution of arbitrary code.
How To Fix
Latest published version: v2.0.1+incompatible as of 22 Oct 2026
go get github.com/bitly/oauth2_proxy@v2.0.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0
This is the first release that contains the fix.
go get github.com/bitly/oauth2_proxy@v2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the latest version of oauth2_proxy to mitigate the risk.
Conclusion
The open redirect vulnerability in oauth2_proxy can be mitigated by upgrading to version 2.2 or later. This will ensure that the vulnerability is patched and no longer exploitable. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/bitly/oauth2_proxy →
FAQ
oauth2_proxy is a Bitly library written in Go that acts as a reverse proxy and provides authentication and authorization capabilities using OAuth2 providers.
The impact of this vulnerability depends on the attacker's intentions and the user's actions. It can potentially lead to phishing attacks, disclosure of sensitive information, or execution of arbitrary code.
To fix this vulnerability, it is recommended to upgrade to version 2.2 or later of oauth2_proxy.
No, only versions 2.1 and earlier are affected. Version 2.2 and later have the vulnerability patched.
Yes, the CVSS score for this vulnerability is 6.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/bitly/oauth2_proxy.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.