CVE-2020-5233

Open Redirect in OAuth2 Proxy

State: Published
Severity: 5.9 Medium
Published: Jan 30, 2020
Updated: Aug 4, 2024
Reserved: Jan 2, 2020

Description

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L	GitHub_M

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
OAuth2 Proxypusher	< 5.0.0Affected

References

https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv
https://github.com/pusher/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2
https://github.com/pusher/oauth2_proxy/releases/tag/v5.0.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.