What’s Vulnerable › Products

oauth2-proxy vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your oauth2-proxy version is affected

Latest oauth2-proxy vulnerabilities

• CVE-2026-76835 — OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set (CVSS 9.1)
• CVE-2026-41059 — OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex (CVSS 8.2)
• CVE-2026-40575 — OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing (CVSS 9.1)
• CVE-2026-40574 — OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims (CVSS 6.8)
• CVE-2026-34457 — OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode (CVSS 9.1)
• CVE-2026-34454 — OAuth2 Proxy: Session cookie not cleared when rendering sign-in page (CVSS 3.5)
• CVE-2025-64484 — OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation (CVSS 8.5)
• CVE-2025-54576 — OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion (CVSS 9.1)
• CVE-2021-21411 — Incorrect authorization in OAuth2-Proxy (CVSS 5.5)
• CVE-2021-21291 — Subdomain checking of whitelisted domains could allow unintended redirects (CVSS 6.1)
• CVE-2020-4037 — Open Redirect in OAuth2 Proxy (CVSS 5.4)
• CVE-2020-11053 — Open Redirect in OAuth2 Proxy (CVSS 6.1)
• CVE-2020-5233 — Open Redirect in OAuth2 Proxy (CVSS 6.1)
• CVE-2017-1000070 — (CVSS 6.1)
• CVE-2017-1000069 — (CVSS 8.8)