Please see our community docs for our security policy.
Security: oauth2-proxy/oauth2-proxy
Security
SECURITY.md
-
Authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusionGHSA-7rh7-c77v-6434 published
Jul 30, 2025 by tuunitCritical -
`--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0GHSA-652x-m2gr-hppm published
Mar 25, 2021 by JoelSpeedModerate -
Subdomain checking of whitelisted domains could allow unintended redirectsGHSA-4mf2-f3wh-gvf2 published
Feb 1, 2021 by JoelSpeedModerate -
New OpenRedirect cases have been foundGHSA-5m6c-jp6f-2vcv published
Jun 27, 2020 by JoelSpeedHigh -
Open Redirect Vulnerability with encoded Whitespace charactersGHSA-j7px-6hwj-hpjg published
May 6, 2020 by JoelSpeedHigh -
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirectGHSA-qqxw-m5fj-f7gv published
Jan 29, 2020 by starkersHigh
Learn more about advisories related to oauth2-proxy/oauth2-proxy in the GitHub Advisory Database