oauth2-proxy vulnerabilities
10 published CVEs name oauth2-proxy among the affected products.
- 10Published CVEs10 of them scored
- 6Last 12 monthspublished in the last year
- 4Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-76835
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
oauth2-proxy · oauth2-proxy
Critical9.3 - CVE-2026-40575
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
oauth2-proxy · oauth2-proxy
Critical9.1 - CVE-2026-41059
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
oauth2-proxy · oauth2-proxy
High8.2 - CVE-2026-40574
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
oauth2-proxy · oauth2-proxy
Medium6.8 - CVE-2026-34457
OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
oauth2-proxy · oauth2-proxy
Critical9.1 - CVE-2026-34454
OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
oauth2-proxy · oauth2-proxy
Low3.5 - CVE-2025-64484
OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation
oauth2-proxy · oauth2-proxy
High8.5 - CVE-2025-54576
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
oauth2-proxy · oauth2-proxy
Critical9.1 - CVE-2021-21411
Incorrect authorization in OAuth2-Proxy
oauth2-proxy · oauth2-proxy
Medium5.5 - CVE-2021-21291
Subdomain checking of whitelisted domains could allow unintended redirects
oauth2-proxy · oauth2-proxy
Medium4.7