GoPackage

github.com/oauth2-proxy/oauth2-proxy

13 known vulnerabilities (4 critical, 3 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: v3.2.0+incompatible (Apr 12, 2019): affected by 12 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 13 · 4 critical, 3 high, 5 medium, 1 low

Releases: 500+ since v3.0.0+incompatible (Jan 14, 2019)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-76835
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2026-40575
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2026-41059
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2026-40574
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2026-34457
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2026-34454
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2025-64484
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2025-54576
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2021-21411
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2021-21291
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2020-4037
No published release is affected
No published release is affected
CVE-2020-11053
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
CVE-2020-5233
Affects v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 13

CVE-2026-76835Critical 9.3
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2026-40575Critical 9.1
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2026-41059High 8.2
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2026-40574Medium 6.8
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2026-34457Critical 9.1
OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
Affected: through 3.2.0; all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2026-34454Low 3.5
OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2025-64484High 8.5
OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2025-54576Critical 9.1
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2021-21411Medium 5.5
Incorrect authorization in OAuth2-Proxy
Affected: all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2021-21291Medium 4.7
Subdomain checking of whitelisted domains could allow unintended redirects
Affected: through 3.2.0; all versions.
No fix released. The latest release, v3.2.0+incompatible, is still affected.
CVE-2020-4037Medium 4.3
Open Redirect in OAuth2 Proxy
Affected: from 5.1.1, fixed in 6.0.0.
No fix released. The advisory names 6.0.0 as the fix, which the registry doesn't have yet.
CVE-2020-11053High 7.1
Open Redirect in OAuth2 Proxy
Affected: fixed in 5.1.1.
No fix released. The advisory names 5.1.1 as the fix, which the registry doesn't have yet. The latest release, v3.2.0+incompatible, is still affected.
CVE-2020-5233Medium 5.9
Open Redirect in OAuth2 Proxy
Affected: fixed in 5.0.0.
No fix released. The advisory names 5.0.0 as the fix, which the registry doesn't have yet. The latest release, v3.2.0+incompatible, is still affected.