TI-2026-29315 CVE-2026-40575 · GHSA-7x63-xv5r-3p2x
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
Priority MEDIUM 48
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
Vulnerabilities
13 records
TI-2026-29698 CVE-2026-41059 · GHSA-pxq7-h93f-9jrg
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
Priority MEDIUM 41
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
TI-2026-29314 CVE-2026-40574 · GHSA-c5c4-8r6x-56w3
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
Priority LOW 31
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
TI-2026-26722 CVE-2026-34457 · GHSA-5hvv-m4w4-gf6v
OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
Priority MEDIUM 48
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
TI-2026-26719 CVE-2026-34454 · GHSA-f24x-5g9q-753f
OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
Priority LOW 16
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
TI-2025-34353 CVE-2025-54576 · GHSA-7rh7-c77v-6434
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
Priority MEDIUM 50
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups.
TI-2021-04509 CVE-2021-21411 · GHSA-652x-m2gr-hppm
Incorrect authorization in OAuth2-Proxy
Priority LOW 27
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers.
TI-2021-04391 CVE-2021-21291 · GHSA-4mf2-f3wh-gvf2
Subdomain checking of whitelisted domains could allow unintended redirects
Priority LOW 30
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group.
TI-2020-03526 CVE-2020-4037 · GHSA-5m6c-jp6f-2vcv
Open Redirect in OAuth2 Proxy
Priority LOW 26
In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow.
TI-2020-08927 CVE-2020-11053 · GHSA-j7px-6hwj-hpjg
Open Redirect in OAuth2 Proxy
Priority LOW 33
In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability.
TI-2020-04289 CVE-2020-5233 · GHSA-qqxw-m5fj-f7gv
Open Redirect in OAuth2 Proxy
Priority LOW 30
OAuth2 Proxy before 5.0 has an open redirect vulnerability.
TI-2017-14409 CVE-2017-1000070 · GHSA-jm34-xm8m-w958
The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect…
Priority LOW 29
The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow.
TI-2017-14408 CVE-2017-1000069 · GHSA-rrm8-32g4-w8m3
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
Priority LOW 39
CSRF in Bitly oauth2_proxy 2.1 during authentication flow