4.7
Medium
CVE-2021-21291 OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers…
Description
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| oauth2-proxy 7.0 | earliest → < 7.0.0 | 7.0.0 |
Other CVEs of oauth2-proxy
The 10 CVEs of oauth2-proxy →
CVE-2026-76835
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication,…
9.3
Critical
CVE-2026-40575
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers
9.1
Critical
CVE-2026-41059
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers
8.2
High
CVE-2026-40574
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers
6.8
Medium