CVE-2020-5233

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.

Score

CVSS 3.1 6.1 Medium

Status

Modified - security-advisories@github.com

Published

2020-01-30

Last modified

2024-08-04

Weaknesses

CWE-601

Affected products

• Oauth2 Proxy (Oauth2 Proxy Project)
• Oauth2 Proxy (Pusher)

References

• https://github.com/pusher/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2
• https://github.com/pusher/oauth2_proxy/releases/tag/v5.0.0
• https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv