CVE-2020-11053: Open Redirect in OAuth2 Proxy
Summary
CVE-2020-11053: Open Redirect in OAuth2 Proxy. Affects github.com/oauth2-proxy/oauth2-proxy versions < 5.1.1. Fixed in 5.1.1. How to fix ↓
Also tracked for
- oauth2-proxy · Bitnami
The same CVE-2020-11053 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OAuth2 Proxy is a Go-based open-source project that provides a reverse proxy and authentication solution for securing web applications with OAuth2 providers. It allows users to authenticate with various OAuth2 providers and then proxies requests to the backend application. This vulnerability affects versions prior to 5.1.1 of the oauth2-proxy package.
Vulnerability Detail
The vulnerability identified as CVE-2020-11053 is an open redirect issue in OAuth2 Proxy. When users provide a redirect address for the proxy during the authentication flow, the proxy validates the redirect URL to prevent malicious actors from redirecting users to potentially harmful sites. However, the validation can be bypassed by crafting a redirect URL with HTML encoded whitespace characters. This allows an attacker to redirect users to any URL provided, potentially leading to phishing attacks or other malicious activities.
How To Fix
Latest published version: v3.2.0+incompatible as of 22 Oct 2026
go get github.com/oauth2-proxy/oauth2-proxy@v3.2.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1.1
This is the first release that contains the fix.
go get github.com/oauth2-proxy/oauth2-proxy@v5.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to version 5.1.1 or later of the OAuth2 Proxy package.
Conclusion
The open redirect vulnerability in OAuth2 Proxy (CVE-2020-11053) allows attackers to bypass redirect URL validation and potentially redirect users to malicious sites. Users of OAuth2 Proxy should upgrade to version 5.1.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/oauth2-proxy/oauth2-proxy →
FAQ
OAuth2 Proxy is a Go-based open-source project that provides a reverse proxy and authentication solution for securing web applications with OAuth2 providers.
The vulnerability allows an attacker to bypass redirect URL validation in OAuth2 Proxy, potentially leading to phishing attacks or other malicious activities.
To fix this vulnerability, upgrade to version 5.1.1 or later of the OAuth2 Proxy package.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
This vulnerability was reported by multiple researchers, including @rootxharsh, @iamnoooob, and @mik317.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/oauth2-proxy/oauth2-proxy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
