Executive brief
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
Affected products
- Go github.com/oauth2-proxy/oauth2-proxy
Junglewise Threat Intelligence
CVE-2020-5233: The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
CVE-2020-5233 · Severity: low · CVSS 3.1 · Published 2021-12-20
Technologies: github.com/oauth2-proxy/oauth2-proxy (Go). Vendors: Go.
Related threats
- OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
- OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
- OAuth2 Proxy authentication bypass via health check User-Agent spoofing
- OAuth2 Proxy insufficient session expiration in sign-in page handler
- GO-2025-4113 - OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-pr