Priority HIGH 81
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00453 · Published 2026-08-24 · Fixed CWE-290
Priority MEDIUM 50
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01214 · Published 2025-07-30 · Partial fix · 7.11.0 CWE-290
Priority MEDIUM 48
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00477 · Published 2026-04-21 · Partial fix · 7.15.2 CWE-290
Priority MEDIUM 48
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00475 · Published 2026-04-14 · Fixed in 7.15.2 CWE-290
Priority MEDIUM 41
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00275 · Published 2026-04-21 · Partial fix · 7.15.2 CWE-288
Priority LOW 39
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00739 · Published 2017-07-13 · Fixed in 2.2.0 CWE-352
Priority LOW 38
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups.
CVSS 3.1HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00658 · Published 2025-11-10 · Partial fix · 7.13.0 CWE-644
Priority LOW 33
In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.0079 · Published 2020-05-07 · Fixed in 5.1.1 CWE-601
Priority LOW 31
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · No interaction · EPSS 0.00209 · Published 2026-04-21 · Partial fix · 7.15.2 CWE-863
Priority LOW 30
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01595 · Published 2021-02-02 · Fixed in 7.0.0 CWE-601
Priority LOW 30
OAuth2 Proxy before 5.0 has an open redirect vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01304 · Published 2020-01-30 · Fixed in 5.0.0 CWE-601
Priority LOW 29
The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00996 · Published 2017-07-13 · Fixed in 2.2.0 CWE-601
Priority LOW 27
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.01069 · Published 2021-03-26 · Fixed in 7.1.0 CWE-863
Priority LOW 26
In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00896 · Published 2020-06-29 · Fixed in 6.0.0 CWE-601
Priority LOW 16
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
CVSS 3.1LOW 3.5· Physical · No auth · No interaction · EPSS 0.00183 · Published 2026-04-14 · Fixed in 7.15.2 CWE-384
THREATIST.IORead the docs