CVE-2021-21291 json
Subdomain checking of whitelisted domains could allow unintended redirects
published 2021-02-02 5 y ago modified 2026-09-10 1 mo ago also BIT-oauth2-proxy-2021-21291 , EUVD-2021-0944 , GHSA-4mf2-f3wh-gvf2 , GO-2022-0790
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.
Patch / fix
- go github.com/oauth2-proxy/oauth2-proxy/v7 7.0.0
- bitnami oauth2-proxy 7.0.0
- oauth2_proxy_project oauth2_proxy 7.0.0
Exploit prediction
1.59% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/oauth2-proxy/oauth2-proxy/v7 | <7.0.0 |
7.0.0 |
| go | github.com/oauth2-proxy/oauth2-proxy | <=3.2.0 all versions |
no fix listed |
| bitnami | oauth2-proxy | <7.0.0 |
7.0.0 |
Affected products
- oauth2-proxy oauth2-proxy
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725
web, patch, third-party-advisory, advisory
-
github.com
/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2
web, exploit, third-party-advisory, advisory
-
github.com
/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0
web, release-notes, third-party-advisory, advisory
-
pkg.go.dev
/github.com/oauth2-proxy/oauth2-proxy/v7
web, product, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-21291
advisory, web
Sources
- CVE List CVE-2021-21291
- GitHub Advisory GHSA-4mf2-f3wh-gvf2
- NVD CVE-2021-21291
- OSV BIT-oauth2-proxy-2021-21291
- OSV GO-2022-0790
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.