CVSS 3.1
3.5 lowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2026-34454
Low (3.5) in oauth2 proxy project oauth2 proxy. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2.
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations or devices, a subsequent user could continue to use the previous user's authenticated session. Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected. This issue is fixed in 7.15.2
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-384, CWE-613
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oauth2_proxy_project:oauth2_proxy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f24x-5g9q-753f | Go | github.com/oauth2-proxy/oauth2-proxy/v7 | >=7.11.0 <7.15.2 | 7.15.2 |
| GO-2026-5341 | Go | github.com/oauth2-proxy/oauth2-proxy | all versions | no fix published |
| GO-2026-5341 | Go | github.com/oauth2-proxy/oauth2-proxy/v7 | >=7.11.0 <7.15.2 | 7.15.2 |