CVE-2020-4037

MEDIUM

OAuth2 Proxy 5.1.1-6.0.0 - Open Redirect via Authentication Flow

Title source: llm
STIX 2.1

Description

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. This has been fixed in version 6.0.0.

References (2)

Core 2

Scores

CVSS v3 4.3
EPSS 0.0090
EPSS Percentile 54.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE
CWE-601
Status published
Products (2)
oauth2-proxy/oauth2-proxy 5.1.1 - 6.0.0Go
oauth2_proxy_project/oauth2_proxy 5.1.1 - 6.0.0
Published Jun 29, 2020
Tracked Since Feb 18, 2026