Oauth2-proxy vulnerabilities

Products

• Oauth2-proxy 10

Newest

• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex CVE-2026-41059 Fix available 8.2 HighApril 15, 2026
• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims CVE-2026-40574 Fix available 6.8 MediumApril 15, 2026
• oauth2-proxy OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set CVE-2026-76835 9.3 CriticalApril 15, 2026
• oauth2-proxy, oauth2 proxy project proxy, red hat ceph storage 9 +2 more OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing CVE-2026-40575 Fix available 9.1 CriticalApril 15, 2026
• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CVE-2026-34457 Fix available 9.1 CriticalApril 14, 2026
• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy: Session cookie not cleared when rendering sign-in page CVE-2026-34454 Fix available 3.5 LowApril 14, 2026
• oauth2-proxy OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation CVE-2025-64484 Fix available 8.5 HighNovember 10, 2025
• oauth2-proxy, oauth2 proxy project proxy +1 more OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion CVE-2025-54576 Fix available 9.1 CriticalJuly 30, 2025
• oauth2-proxy, oauth2 proxy project proxy +1 more Incorrect authorization in OAuth2-Proxy CVE-2021-21411 Fix available 5.5 MediumMarch 26, 2021
• oauth2 proxy project proxy, oauth2-proxy +1 more Subdomain checking of whitelisted domains could allow unintended redirects CVE-2021-21291 Fix available 4.7 MediumFebruary 2, 2021