Vulnerabilities in oauth2-proxy
10 resultsCVE-2021-21291MEDIUMSubdomain checking of whitelisted domains could allow unintended redirectsEPSS 1.6%CVE-2025-54576CRITICALOAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusionEPSS 1.2%CVE-2021-21411MEDIUMIncorrect authorization in OAuth2-ProxyEPSS 1.1%CVE-2025-64484HIGHOAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalationEPSS 0.7%CVE-2026-40575CRITICALOAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header SpoofingEPSS 0.5%CVE-2026-34457CRITICALOAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request ModeEPSS 0.5%CVE-2026-76835CRITICALOAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy SetEPSS 0.5%CVE-2026-41059HIGHOAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regexEPSS 0.3%CVE-2026-40574MEDIUMOAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email ClaimsEPSS 0.2%CVE-2026-34454LOWOAuth2 Proxy: Session cookie not cleared when rendering sign-in pageEPSS 0.2%