{"id":"CVE-2020-5233","aliases":["GHSA-qqxw-m5fj-f7gv","BIT-oauth2-proxy-2020-5233"],"title":"The pattern '/\\domain.com' is not disallowed when redirecting, allowing for open redirect","summary":"The pattern '/\\domain.com' is not disallowed when redirecting, allowing for open redirect","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L","vendor":"oauth2-proxy","product":"github.com/oauth2-proxy/oauth2-proxy","ecosystem":"go","affected":["github.com/oauth2-proxy/oauth2-proxy < 5.0.0"],"patched":["github.com/oauth2-proxy/oauth2-proxy 5.0.0"],"published":"2021-12-20","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qqxw-m5fj-f7gv","references":[{"url":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-qqxw-m5fj-f7gv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5233"},{"url":"https://github.com/oauth2-proxy/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2"},{"url":"https://blog.detectify.com/2019/05/16/the-real-impact-of-an-open-redirect"},{"url":"https://github.com/oauth2-proxy/oauth2_proxy/releases/tag/v5.0.0"}],"tags":["osv","go"],"epss":0.01304,"epssPercentile":0.68788,"ingestedAt":"2026-07-09T18:56:36.866Z","slug":"CVE-2020-5233","body":"## Overview\n\n### Impact\nAn open redirect vulnerability has been found in `oauth2_proxy`. Anyone who uses `oauth2_proxy` may potentially be impacted. \n\nFor a context [detectify] have an in depth blog post about the potential impact of an open redirect. Particularly see the OAuth section.\n\n**tl;dr**: People's authentication tokens could be silently harvested by an attacker. e.g:\n`facebook.com/oauth.php?clientid=123&state=abc&redirect_url=https://yourdomain.com/red.php?url%3dhttps://attacker.com/`\n\n### Patches\n\n@sauyon found the issue, and has submitted a patch. \n\n```\ndiff --git a/oauthproxy.go b/oauthproxy.go\nindex 72ab580..f420df6 100644\n--- a/oauthproxy.go\n+++ b/oauthproxy.go\n@@ -517,7 +517,7 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error)\n // IsValidRedirect checks whether the redirect URL is whitelisted\n func (p *OAuthProxy) IsValidRedirect(redirect string) bool {\n \tswitch {\n-\tcase strings.HasPrefix(redirect, \"/\") && !strings.HasPrefix(redirect, \"//\"):\n+\tcase strings.HasPrefix(redirect, \"/\") && !strings.HasPrefix(redirect, \"//\") && !strings.HasPrefix(redirect, \"/\\\\\"):\n \t\treturn true\n \tcase strings.HasPrefix(redirect, \"http://\") || strings.HasPrefix(redirect, \"https://\"):\n \t\tredirectURL, err := url.Parse(redirect)\n```\n\nThis patch will be applied to the next release, which is scheduled for when this is publicly disclosed.\n\n### Workarounds\n\nAt this stage there is no work around.\n\n## Affected packages\n\n- `github.com/oauth2-proxy/oauth2-proxy < 5.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/oauth2-proxy/oauth2-proxy 5.0.0`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}