VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/oauth2-proxy/oauth2-proxy: vulnerability history, versions and safety

github.com/oauth2-proxy/oauth2-proxy is a package in the Go ecosystem. Vulert records 12 vulnerabilities for it across 120 releases, from Dec 2021 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
12 vulnerabilities recorded H1 M2 U9
i
9 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
6 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/oauth2-proxy/oauth2-proxy vulnerabilities

Vulert verdict on github.com/oauth2-proxy/oauth2-proxy v3.2.0+incompatible i

Updated on 23 Oct 2026

Careful: 9 of the 12 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 57/100
  • Security Unfixed issues
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Plan around the 9 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v3.2.0+incompatible — unaffected i
  • Vulnerabilities on record 12 over 4 years · 6 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 7.1 i
  • With no published fix 9 i
  • Stars 15,205 i
  • OpenSSF scorecard 4/10 i
  • Last release 72 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/oauth2-proxy/oauth2-proxy, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.1.2-0.20200929162114-7c4479791c70 29 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200929113540-d046782f6171 29 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101706-090eff0197b7 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101506-017b9bcfb7f3 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101506-4eb96126799c 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101506-74918c40d8ba 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101506-8cbf9219bc0e 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101506-97e95fd4ffe4 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101506-9a64e67d5bac 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200928101506-fde09bea4ec8 28 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200924175533-e9aa7acf4e92 24 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200924175018-e0d915cc0347 24 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200924174950-3371284a3698 24 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200924174855-160685abd708 24 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200924174143-6db1aeb9c69c 24 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200924173652-93870ec0ff43 24 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200924173134-56f199a24f31 24 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200923165440-55a941b76e15 23 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200923001300-4a04ff452929 23 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200921200427-8eb9c69a9abf 21 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200921174354-9d59519a96c5 21 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200911132603-a87beab1a06a 11 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200911103200-e14d6ab791d3 11 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200904143047-ef08d01b982f 04 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200904142041-0eb0024e87ed 04 Sep 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200902152407-ef927fdbcd3c 02 Sep 2020 H1 M1 U9 MIT No Details →
v0.0.0-20200831161845-e4e5580852dc 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200831161845-e4e5580852dc 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200831160152-1337f5618836 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200831155855-841bf77f7f22 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200831155413-bd619ab63e19 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200831155401-b40517bbe3cc 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200831154820-73f00944861f 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200831153145-29b24793e3df 31 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200829082624-bd5fab478d88 29 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200827141524-37026b60cebd 27 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200827140846-43bf36425d6b 27 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200827140132-4134a9010ef6 27 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200827134800-105d5acb7b2b 27 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200825154114-d7abd56981c7 25 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200817154438-5fa5b3186f39 17 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200816190434-d05e08cba340 16 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200816185755-9a338d8a3449 16 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200816185352-16a30002df19 16 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200816120343-aceb9e2762f4 16 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200814203138-0645e19c2409 14 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200814203138-514db45d1a20 14 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200814203138-dcc75410a80a 14 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200814130954-8515da3e9149 14 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200811192205-51a906204447 11 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200811185607-35ed7a313b73 11 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200810221516-b6e78efc1e77 10 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200810104408-d69fd6af2275 10 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809152437-33e04cc52f30 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145541-46cc21d8cff9 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145541-a1358d207035 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145541-e88d29f16a84 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145540-1c8c5b08d70a 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145540-2bb0160bf381 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145540-45222395e0a5 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145540-542bf1fad1dc 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145540-ad52587ae691 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200809145539-65c228394fb1 09 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200807073217-7b21f53aad1a 07 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200806224405-81ec9edf53ec 06 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200804145853-0cf0fd88e85a 04 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200804062900-6e31eb28d501 04 Aug 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200729112308-bbf00bc92b6c 29 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200729044221-43189a7854a4 29 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200722102349-2318716a8992 22 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200722051317-19836f85acbd 22 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200721153813-88ef888752fb 21 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200720105047-c5da3dff9cff 20 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719202513-9643a0b10c9b 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719194017-f141f7cea0c6 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719191056-1aac37d2b188 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719173455-d4dd34a65a33 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719162458-3f0014317556 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719162412-eb234011eb51 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719162142-034f057b6032 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719162142-276832192984 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719162142-7d6f2a3f454c 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719162142-c81a7ed1976a 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719130136-6b2706981213 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719130136-71dc70222b70 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719130136-d43b372ca9bb 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719071753-5dbcd737229e 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200719071753-e932381ba789 19 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200718162950-e02f99eb581a 18 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200718100149-2981a5ed1a38 18 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200718100149-7d8ee6125421 18 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200718100149-e73db7df7bf3 18 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200714230513-895403cb9b3c 14 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200714224644-abeb0236d879 14 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200714220210-bb5977095faf 14 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200713195605-a09eecc6a261 13 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200712150934-dd361389659e 12 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200712145019-18716142b457 12 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200711173646-19b56061268f 11 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200711101412-d1c7be565ba0 11 Jul 2020 H1 M1 U9 MIT No Details →
v1.1.2-0.20200711101058-64ae31b5a098 11 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200707204338-e6903d8c1f38 07 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200707195143-7ffe9b76203c 07 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200707085538-a999270cf3b4 07 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706200155-d29766609bc6 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706193800-de9e65a63adf 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706193736-d0b6c0496084 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706173131-fbf406324523 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706173128-02410d3919f3 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706173111-028a0ed62e8c 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706173109-53142455b6ed 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706172958-21ef86b5942c 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706172957-0bc0feb4bb20 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706133336-9d39816709f0 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706123919-830065a128bd 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706111806-efa1e9b4480a 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706100902-97ab3fa00593 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706100431-4c1047866b79 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706100416-416c8b0a5c2e 06 Jul 2020 H1 M1 U9 — No Details →
v1.1.2-0.20200706080013-215aeec8b9f7 06 Jul 2020 H1 M1 U9 — No Details →

The newest 120 of 987 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 3
  • 2024 1
  • 2025 3
  • 2026 5

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 6 of the 12 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/oauth2-proxy/oauth2-proxy

The 5 most severe of 12 vulnerabilities recorded for this package

Search all 12 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2020-11053: Open Redirect in OAuth2 Proxy 7.1 high 5.1.1 20 Dec 2021
CVE-2020-5233: Open Redirect Vulnerability in oauth2-proxy 5.9 medium 5.0.0 20 Dec 2021
CVE-2020-4037: Open Redirect in OAuth2 Proxy 4.3 medium 6.0.0 20 Dec 2021
CVE-2026-40574: Authorization Bypass in OAuth2 Proxy via Malformed Multi-@ Email Claims N/A unrated No fix published 25 Jun 2026
CVE-2026-40575: OAuth2 Proxy Authentication Bypass via X-Forwarded-Uri Header Spoofing N/A unrated No fix published 25 Jun 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/oauth2-proxy/oauth2-proxy

Is github.com/oauth2-proxy/oauth2-proxy safe to use?

Vulert records 12 vulnerabilities for github.com/oauth2-proxy/oauth2-proxy in Go: 0 critical, 1 high, 2 medium and 0 low, plus 9 not yet rated. 9 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/oauth2-proxy/oauth2-proxy's Vulert package health score?

Vulert scores github.com/oauth2-proxy/oauth2-proxy 57/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/oauth2-proxy/oauth2-proxy should I use?

v3.2.1-0.20190719101153-f29e353586c1+incompatible is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/oauth2-proxy/oauth2-proxy have?

12 vulnerabilities are recorded for github.com/oauth2-proxy/oauth2-proxy in the Go ecosystem: 0 critical, 1 high, 2 medium and 0 low, plus 9 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/oauth2-proxy/oauth2-proxy vulnerabilities disclosed?

6 vulnerabilities were recorded for github.com/oauth2-proxy/oauth2-proxy in the last 12 months, and the oldest entry in this database dates to 20 Dec 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/oauth2-proxy/oauth2-proxy are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/oauth2-proxy/oauth2-proxy for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/oauth2-proxy/oauth2-proxy version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.