GHSA-2r2v-9pf8-6342
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover
Impact
Users of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.
Patches
The problem was fixed in the latest alpha release, v2.0.0-alpha.3. The docker images for the tag 'latest' built from the master branch also include the fix.
What each source reports
GitHub AdvisoriesNo score
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover
Impact
Users of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.
Patches
The problem was fixed in the latest alpha release, v2.0.0-alpha.3. The docker images for the tag 'latest' built from the master branch also include the fix.
- Record
GHSA-2r2v-9pf8-6342- Updated
- 2026-11-02
OSVNo score
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover
Impact
Users of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.
Patches
The problem was fixed in the latest alpha release, v2.0.0-alpha.3. The docker images for the tag 'latest' built from the master branch also include the fix.
- Record
GHSA-2r2v-9pf8-6342- Updated
- 2026-11-02
OSVGO-2025-3371No score
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/h44z/wg-portal from v2.0.0-alpha.1 before v2.0.0-alpha.3.
- Record
GO-2025-3371- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/h44z/wg-portalGo | 2.0.0-alpha.1 up to 2.0.0-alpha.3 | 2.0.0-alpha.3 |
github.com/h44z/wg-portalGo | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2r2v-9pf8-6342 is a vulnerability with no CVSS score yet in github.com/h44z/wg-portal, published January 7, 2025. No source lists public exploit code. Fixed in github.com/h44z/wg-portal 2.0.0-alpha.3.