Riskcovery

CVE-2026-83589

Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

State
Published
Severity
6.1 Medium
Published
Oct 1, 2026
Updated
Oct 30, 2026
Reserved
Aug 31, 2026

Read the record on cve.org

Description

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nredhat

Weaknesses

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

ProductVersions
Red Hat OpenShift Container Platform 4.12Red Hat
  • 1792974337 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat
  • 1791837363 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat
  • 1791632336 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat
  • 1792878232 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • 1790882320 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat
  • 1790807096 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat
  • 1790704224 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat
  • 1790706478 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat
  • 1790724885 and laterNot affected
Red Hat OpenShift Container Platform 5Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.