Read the docs
TI-2021-04391 Aliases CVE-2021-21291GHSA-4mf2-f3wh-gvf2

Subdomain checking of whitelisted domains could allow unintended redirects

Priority LOW 30CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.

Why it matters now

EPSS 0.01595 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed oauth2-proxy (oauth2-proxy): 7.0.0github.com/oauth2-proxy/oauth2-proxy/v7 (Go): 7.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
oauth2-proxyoauth2-proxybefore 7.0.07.0.0Patch availableCNA
—github.com/oauth2-proxy/oauth2-proxy/v7 (Go)before 7.0.07.0.0Patch availableGHSA-4mf2-f3wh-gvf2
—github.com/oauth2-proxy/oauth2-proxy (Go)up to 3.2.0—No fix listedGHSA-4mf2-f3wh-gvf2
  • oauth2-proxy Vendoroauth2-proxy Affected before 7.0.0 Fixed in 7.0.0 Patch available CNA
  • github.com/oauth2-proxy/oauth2-proxy/v7 (Go) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-4mf2-f3wh-gvf2
  • github.com/oauth2-proxy/oauth2-proxy (Go) Vendor— Affected up to 3.2.0 Fixed in — No fix listed GHSA-4mf2-f3wh-gvf2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*before 7.0.0Vulnerableoauth2-proxy
  • cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:* Versions before 7.0.0 Vulnerable ·oauth2-proxy

Remediation

  • Fix · CNA oauth2-proxy (oauth2-proxy) Fixed in 7.0.0
  • Fix · GHSA-4mf2-f3wh-gvf2 github.com/oauth2-proxy/oauth2-proxy/v7 (Go) Fixed in 7.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21291
  2. 2026-10-03 Alias added: GHSA-4mf2-f3wh-gvf2

References

Exploit 1

Patch 1

Advisory 3

  • TI-2025-34353 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion CVSS 3.1CRITICAL 9.1
  • TI-2026-29315 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing CVSS 3.1CRITICAL 9.1
  • TI-2026-26722 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CVSS 3.1CRITICAL 9.1
  • TI-2026-29698 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex CVSS 3.1HIGH 8.2
  • TI-2017-14408 CSRF in Bitly oauth2_proxy 2.1 during authentication flow CVSS 3.0HIGH 8.8
  • TI-2020-08927 Open Redirect in OAuth2 Proxy CVSS 3.1HIGH 7.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences