CVE-2020-5233 Open Redirect in OAuth2 Proxy

What is CVE-2020-5233?

CVE-2020-5233 is a medium-severity vulnerability in pusher OAuth2 Proxy, published on 30 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.

Weakness: CWE-601

Which versions are affected by CVE-2020-5233?

3 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy and oauth2-proxy. It affects 1 product.

Products include Oauth2 Proxy Project Oauth2 Proxy.

How do I fix CVE-2020-5233?

Upgrade github.com/oauth2-proxy/oauth2-proxy to 5.0.0 or later.

Is CVE-2020-5233 being exploited?

There is no known exploitation of CVE-2020-5233 in the wild and no public exploit code.

Other vulnerabilities in pusher OAuth2 Proxy

• CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing Critical 9.1
• CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode Critical 9.1
• CVE-2025-54576 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion Critical 9.1
• CVE-2017-1000069 Cross-site Request Forgery (CSRF) High 8.8
• CVE-2026-41059 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-oauth2-proxy-2020-5233, GHSA-qqxw-m5fj-f7gv.