Oauth2 Proxy Project Proxy vulnerabilities

• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex CVE-2026-41059 Fix available 8.2 HighApril 15, 2026
• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims CVE-2026-40574 Fix available 6.8 MediumApril 15, 2026
• oauth2-proxy, oauth2 proxy project proxy, red hat ceph storage 9 +2 more OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing CVE-2026-40575 Fix available 9.1 CriticalApril 15, 2026
• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CVE-2026-34457 Fix available 9.1 CriticalApril 14, 2026
• oauth2 proxy project proxy, oauth2-proxy +1 more OAuth2 Proxy: Session cookie not cleared when rendering sign-in page CVE-2026-34454 Fix available 3.5 LowApril 14, 2026
• oauth2-proxy, oauth2 proxy project proxy +1 more OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion CVE-2025-54576 Fix available 9.1 CriticalJuly 30, 2025
• oauth2-proxy, oauth2 proxy project proxy +1 more Incorrect authorization in OAuth2-Proxy CVE-2021-21411 Fix available 5.5 MediumMarch 26, 2021
• oauth2 proxy project proxy, oauth2-proxy +1 more Subdomain checking of whitelisted domains could allow unintended redirects CVE-2021-21291 Fix available 4.7 MediumFebruary 2, 2021
• oauth2 proxy proxy, pusher oauth2 proxy +1 more Open Redirect in OAuth2 Proxy CVE-2020-4037 Fix available 4.3 MediumJune 29, 2020
• oauth2 proxy proxy, pusher oauth2 proxy +1 more Open Redirect in OAuth2 Proxy CVE-2020-11053 Fix available 7.1 HighMay 7, 2020
• oauth2 proxy project proxy, pusher oauth2 proxy +1 more Open Redirect in OAuth2 Proxy CVE-2020-5233 Fix available 5.9 MediumJanuary 30, 2020
• oauth2 proxy project proxy Open Redirect in oauth2_proxy CVE-2017-1000070 Fix available 6.1 MediumJuly 13, 2017
• oauth2 proxy project proxy Cross-site Request Forgery (CSRF) CVE-2017-1000069 Fix available 8.8 HighJuly 13, 2017