# github.com/oauth2-proxy/oauth2-proxy (Go) vulnerabilities

13 known vulnerabilities (4 critical, 3 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v3.2.0+incompatible (Apr 12, 2019): affected by 12 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Releases: 500+ since v3.0.0+incompatible (Jan 14, 2019)
- Registry: https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-76835: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2026-40575: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2026-41059: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2026-40574: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2026-34457: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2026-34454: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2025-64484: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2025-54576: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2021-21411: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2021-21291: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2020-4037: no published release is affected
- CVE-2020-11053: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)
- CVE-2020-5233: v2.0.2-0.20160412052613-60a59ce7b18b+incompatible to v3.2.1-0.20190719101153-f29e353586c1+incompatible (through the newest release)

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (13)

### [CVE-2026-76835](https://cve.now/CVE-2026-76835): OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

- Severity: Critical 9.3
- Published: Aug 24, 2026
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2026-40575](https://cve.now/CVE-2026-40575): OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

- Severity: Critical 9.1
- Published: Apr 21, 2026
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2026-41059](https://cve.now/CVE-2026-41059): OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip\_auth\_routes and skip\_auth\_regex

- Severity: High 8.2
- Published: Apr 21, 2026
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2026-40574](https://cve.now/CVE-2026-40574): OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims

- Severity: Medium 6.8
- Published: Apr 21, 2026
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2026-34457](https://cve.now/CVE-2026-34457): OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth\_request Mode

- Severity: Critical 9.1
- Published: Apr 14, 2026
- Affected: through 3.2.0; all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2026-34454](https://cve.now/CVE-2026-34454): OAuth2 Proxy: Session cookie not cleared when rendering sign-in page

- Severity: Low 3.5
- Published: Apr 14, 2026
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2025-64484](https://cve.now/CVE-2025-64484): OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation

- Severity: High 8.5
- Published: Nov 10, 2025
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2025-54576](https://cve.now/CVE-2025-54576): OAuth2-Proxy has authentication bypass in oauth2-proxy skip\_auth\_routes due to Query Parameter inclusion

- Severity: Critical 9.1
- Published: Jul 30, 2025
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2021-21411](https://cve.now/CVE-2021-21411): Incorrect authorization in OAuth2-Proxy

- Severity: Medium 5.5
- Published: Mar 26, 2021
- Affected: all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2021-21291](https://cve.now/CVE-2021-21291): Subdomain checking of whitelisted domains could allow unintended redirects

- Severity: Medium 4.7
- Published: Feb 2, 2021
- Affected: through 3.2.0; all versions.
- No fix released. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2020-4037](https://cve.now/CVE-2020-4037): Open Redirect in OAuth2 Proxy

- Severity: Medium 4.3
- Published: Jun 29, 2020
- Affected: from 5.1.1, fixed in 6.0.0.
- No fix released. The advisory names 6.0.0 as the fix, which the registry doesn't have yet.

### [CVE-2020-11053](https://cve.now/CVE-2020-11053): Open Redirect in OAuth2 Proxy

- Severity: High 7.1
- Published: May 7, 2020
- Affected: fixed in 5.1.1.
- No fix released. The advisory names 5.1.1 as the fix, which the registry doesn't have yet. The latest release, v3.2.0+incompatible, is still affected.

### [CVE-2020-5233](https://cve.now/CVE-2020-5233): Open Redirect in OAuth2 Proxy

- Severity: Medium 5.9
- Published: Jan 30, 2020
- Affected: fixed in 5.0.0.
- No fix released. The advisory names 5.0.0 as the fix, which the registry doesn't have yet. The latest release, v3.2.0+incompatible, is still affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/oauth2-proxy/oauth2-proxy
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.