CVE-2020-4037Medium· 4.3▾ SunlitOpen Redirect in OAuth2 Proxy
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites.
github.com/oauth2-proxy/oauth2-proxy >= 5.1.1, < 6.0.0Upgrade to a patched release:
github.com/oauth2-proxy/oauth2-proxy 6.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-5233Medium· 5.9The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
CVE-2025-54576Critical· 9.1OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
CVE-2021-21291Medium· 5.4Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy
CVE-2026-40574Medium· 6.8OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
CVE-2021-21411Medium· 5.5OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0