{"id":"GHSA-2r2v-9pf8-6342","aliases":["GO-2025-3371"],"status":"published","title":"WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover","description":"### Impact\nUsers of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.\n\n### Patches\nThe problem was fixed in the latest alpha release, v2.0.0-alpha.3. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-01-07T15:52:16Z","modified":"2025-01-08T19:42:21Z","fixes":[{"ecosystem":"Go","package":"github.com/h44z/wg-portal","fixed_in":["2.0.0-alpha.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/h44z/wg-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-alpha.1"},{"fixed":"2.0.0-alpha.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/h44z/wg-portal","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-alpha.1"},{"fixed":"2.0.0-alpha.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/h44z/wg-portal","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/h44z/wg-portal/security/advisories/GHSA-2r2v-9pf8-6342","tags":["web","advisory"]},{"url":"https://github.com/h44z/wg-portal/commit/62dbdfe0f96045d46e121d509fc181fbb7936895","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-2r2v-9pf8-6342"},{"url":"https://github.com/h44z/wg-portal","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2r2v-9pf8-6342","title":"WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover","description":"### Impact\nUsers of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.\n\n### Patches\nThe problem was fixed in the latest alpha release, v2.0.0-alpha.3. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.\n","status":"published","published":"2025-01-07T15:52:16Z","modified":"2025-01-07T15:52:18Z","updated_at":"2026-11-02T14:38:26.167657Z"}],"osv":[{"id":"GHSA-2r2v-9pf8-6342","title":"WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover","description":"### Impact\nUsers of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.\n\n### Patches\nThe problem was fixed in the latest alpha release, v2.0.0-alpha.3. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.\n","status":"published","published":"2025-01-07T15:52:16Z","modified":"2025-01-08T19:42:21.896344Z","updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GO-2025-3371","title":"WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal","description":"WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/h44z/wg-portal from v2.0.0-alpha.1 before v2.0.0-alpha.3.","status":"published","published":"2025-01-08T19:19:42Z","modified":"2025-01-08T19:42:21.896344Z","updated_at":"2026-11-02T15:47:01.728182Z"}]}}