{"id":"CVE-2021-21291","aliases":["GHSA-4mf2-f3wh-gvf2","BIT-oauth2-proxy-2021-21291","GO-2022-0790"],"title":"Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy","summary":"Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","vendor":"oauth2-proxy","product":"github.com/oauth2-proxy/oauth2-proxy/v7","ecosystem":"go","affected":["github.com/oauth2-proxy/oauth2-proxy/v7 < 7.0.0","github.com/oauth2-proxy/oauth2-proxy <= 3.2.0"],"patched":["github.com/oauth2-proxy/oauth2-proxy/v7 7.0.0"],"published":"2021-05-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:04.327848096Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4mf2-f3wh-gvf2","references":[{"url":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21291"},{"url":"https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725"},{"url":"https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0"},{"url":"https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"}],"tags":["osv","go"],"epss":0.01576,"epssPercentile":0.74376,"ingestedAt":"2026-09-12T03:13:01.753Z","slug":"CVE-2021-21291","body":"## Overview\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\nFor users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect.\n\nFor example, if a whitelist domain was configured for `.example.com`, the intention is that subdomains of `example.com` are allowed.\nInstead, `example.com` and `badexample.com` could also match.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nThis is fixed in version 7.0.0 onwards.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nDisable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.\n\n# Original Issue Posted by @semoac:\n\nWhitelist Domain feature is not working as expected because is not matching a dot to ensure the redirect is a subdomain.\n\n## Expected Behavior\n\nIf whitelist domain is set to `.example.com` , then `hack.alienexample.com`  should be rejected as a valid redirect.\n\n## Current Behavior\n\nThe code is removing the `dot`  from `.example.com`  and  only checking if the redirect string end with `example.com`\n\n## Possible Solution\nHere\nhttps://github.com/oauth2-proxy/oauth2-proxy/blob/c377466411f2aee180a732187edb638f2f7e57fb/oauthproxy.go#L661\n\nInclude the dot when checking the string:\n```\nstrings.HasSuffix(redirectHostname, \".\" + domainHostname)\n```\n\n## Steps to Reproduce (for bugs)\n\n```\npackage main\n\nimport (\n\t\"fmt\"\n\t\"strings\"\n)\n\nfunc validOptionalPort(port string) bool {\n\tif port == \"\" || port == \":*\" {\n\t\treturn true\n\t}\n\tif port[0] != ':' {\n\t\treturn false\n\t}\n\tfor _, b := range port[1:] {\n\t\tif b < '0' || b > '9' {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}\n\nfunc splitHostPort(hostport string) (host, port string) {\n\thost = hostport\n\n\tcolon := strings.LastIndexByte(host, ':')\n\tif colon != -1 && validOptionalPort(host[colon:]) {\n\t\thost, port = host[:colon], host[colon+1:]\n\t}\n\n\tif strings.HasPrefix(host, \"[\") && strings.HasSuffix(host, \"]\") {\n\t\thost = host[1 : len(host)-1]\n\t}\n\n\treturn\n}\n\nfunc main() {\n\tdomain := \".example.com\"\n\tdomainHostname, _ := splitHostPort(strings.TrimLeft(domain, \".\"))\n\tredirectHostname := \"https://hack.alienexample.com\"\n\tif (strings.HasPrefix(domain, \".\") && strings.HasSuffix(redirectHostname, domainHostname)) { fmt.Println(\"This should not have happen.\")}\n}\n\n```\n\nUsers of `github.com/oauth2-proxy/oauth2-proxy` are advised to update to `github.com/oauth2-proxy/oauth2-proxy/v7`\n\n## Affected packages\n\n- `github.com/oauth2-proxy/oauth2-proxy/v7 < 7.0.0`\n- `github.com/oauth2-proxy/oauth2-proxy <= 3.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/oauth2-proxy/oauth2-proxy/v7 7.0.0`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}