oauth2-proxy has 6 CVEs on record between 2021 and 2026. The median CVSS is 5.7 (medium), with 1 rated critical. None have a confirmed exploitation report. Most affected products: github.com/oauth2-proxy/oauth2-proxy/v7 (4), github.com/oauth2-proxy/oauth2-proxy (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 0 prev 1
Products
- github.com/oauth2-proxy/oauth2-proxy/v7 4
- github.com/oauth2-proxy/oauth2-proxy 2
Worst active — by depth score
CVE-2025-54576Critical· 9.1OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion50CVE-2026-40574Medium· 6.8OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims37CVE-2020-5233Medium· 5.9The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect33CVE-2021-21411Medium· 5.5OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.030CVE-2021-21291Medium· 5.4Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy30
oauth2-proxy vulnerabilities
CVEs affecting oauth2-proxy, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-40574Medium· 6.8OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
CVE-2025-54576Critical· 9.1OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
CVE-2021-21411Medium· 5.5OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0
OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0
CVE-2020-5233Medium· 5.9The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
CVE-2020-4037Medium· 4.3Open Redirect in OAuth2 Proxy
Open Redirect in OAuth2 Proxy
CVE-2021-21291Medium· 5.4Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy
Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy