Vulnerabilities matching "github.com/oauth2-proxy/oauth2-proxy" — 21 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
Unrated CVE-2026-41059: OAuth2 Proxy Authentication Bypass via Fragment Confusion github.com/oauth2-proxy/oauth2-proxy Go 25 Jun 2026 No fix published
Unrated CVE-2026-34454: OAuth2 Proxy Session Cookie Vulnerability github.com/oauth2-proxy/oauth2-proxy Go 25 Jun 2026 No fix published
Unrated CVE-2026-40574: Authorization Bypass in OAuth2 Proxy via Malformed Multi-@ Email Claims github.com/oauth2-proxy/oauth2-proxy Go 25 Jun 2026 No fix published
Unrated CVE-2026-40575: OAuth2 Proxy Authentication Bypass via X-Forwarded-Uri Header Spoofing github.com/oauth2-proxy/oauth2-proxy Go 25 Jun 2026 No fix published
Unrated CVE-2026-34457: OAuth2 Proxy Health Check User-Agent Matching Bypasses Authentication github.com/oauth2-proxy/oauth2-proxy Go 25 Jun 2026 No fix published
8.2 high Authentication Bypass Vulnerability in OAuth2 Proxy - Fragment Confusion Issue github.com/oauth2-proxy/oauth2-proxy/v7 Go 15 Apr 2026 7.15.2
6.8 medium CVE-2026-40574: OAuth2 Proxy Authorization Bypass via Malformed Multi-@ Email Claims github.com/oauth2-proxy/oauth2-proxy/v7 Go 15 Apr 2026 7.15.2
9.1 critical CVE-2026-40575: OAuth2 Proxy Authentication Bypass via X-Forwarded-Uri Header Spoofing github.com/oauth2-proxy/oauth2-proxy/v7 Go 15 Apr 2026 7.15.2
9.1 critical CVE-2026-34457: OAuth2 Proxy Authentication Bypass via Health Check User-Agent github.com/oauth2-proxy/oauth2-proxy/v7 Go 14 Apr 2026 7.15.2
3.5 low CVE-2026-34454: OAuth2 Proxy Session Cookie Not Cleared on Sign-In Page github.com/oauth2-proxy/oauth2-proxy/v7 Go 14 Apr 2026 7.15.2
Unrated CVE-2025-64484: OAuth2-Proxy Header Smuggling Vulnerability Leading to Privilege Escalation github.com/oauth2-proxy/oauth2-proxy Go 17 Nov 2025 No fix published
8.5 high CVE-2025-64484: OAuth2-Proxy Header Smuggling Vulnerability Leading to Privilege Escalation github.com/oauth2-proxy/oauth2-proxy/v7 Go 12 Nov 2025 7.13.0
Unrated CVE-2021-21411: GitLab Group Authorization Flag Malfunction in OAuth2-Proxy github.com/oauth2-proxy/oauth2-proxy Go 11 Aug 2025 No fix published
Unrated CVE-2025-54576: OAuth2-Proxy Authentication Bypass Due to Query Parameter Inclusion github.com/oauth2-proxy/oauth2-proxy Go 11 Aug 2025 No fix published
9.1 critical CVE-2025-54576: OAuth2-Proxy Authentication Bypass via skip_auth_routes Regex Misconfiguration github.com/oauth2-proxy/oauth2-proxy/v7 Go 30 Jul 2025 7.11.0
5.5 medium CVE-2021-21411: OAuth2-Proxy v7.0.0 GitLab Group Authorization Bypass Vulnerability github.com/oauth2-proxy/oauth2-proxy/v7 Go 30 Jul 2025 7.1.0
Unrated CVE-2021-21291: oauth2-proxy Subdomain Redirect Vulnerability github.com/oauth2-proxy/oauth2-proxy Go 21 Aug 2024 No fix published
5.9 medium CVE-2020-5233: Open Redirect Vulnerability in oauth2-proxy github.com/oauth2-proxy/oauth2-proxy Go 20 Dec 2021 5.0.0
7.1 high CVE-2020-11053: Open Redirect in OAuth2 Proxy github.com/oauth2-proxy/oauth2-proxy Go 20 Dec 2021 5.1.1
4.3 medium CVE-2020-4037: Open Redirect in OAuth2 Proxy github.com/oauth2-proxy/oauth2-proxy Go 20 Dec 2021 6.0.0
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.