Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

oauth2-proxy — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in oauth2-proxy, with AI-generated Chinese analysis, references, and POCs.

Vendor: oauth2-proxy

CVE ID Title CVSS Severity Published
CVE-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set CWE-290 9.1 Critical 2026-08-24
CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing CWE-290 9.1 Critical 2026-04-21
CVE-2026-41059 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex CWE-288 8.2 High 2026-04-21
CVE-2026-40574 OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims CWE-863 6.8 Medium 2026-04-21
CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CWE-290 9.1 Critical 2026-04-14
CVE-2026-34454 OAuth2 Proxy: Session cookie not cleared when rendering sign-in page CWE-613 3.5 Low 2026-04-14
CVE-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation CWE-644 8.5 High 2025-11-10
CVE-2025-54576 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion CWE-290 9.1 Critical 2025-07-30
CVE-2021-21411 Incorrect authorization in OAuth2-Proxy CWE-863 5.5 Medium 2021-03-26
CVE-2021-21291 Subdomain checking of whitelisted domains could allow unintended redirects CWE-601 4.7 Medium 2021-02-02

All 10 known CVE vulnerabilities affecting oauth2-proxy with full Chinese analysis, references, and POCs where available.