CVE-2021-21291 Subdomain checking of whitelisted domains could allow unintended redirects
Attackers can redirect users to malicious sites due to flawed subdomain matching in the whitelist domain feature of OAuth2 Proxy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21291?
CVE-2021-21291 is a medium-severity vulnerability in oauth2-proxy, published on 2 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.
Weakness: CWE-601
Which versions are affected by CVE-2021-21291?
7 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy, oauth2-proxy and github.com/oauth2-proxy/oauth2-proxy/v7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/oauth2-proxy/oauth2-proxy Go | All versions | None |
github.com/oauth2-proxy/oauth2-proxy Go | All versions to 3.2.0 | None |
github.com/oauth2-proxy/oauth2-proxy Go | All versions to 3.2.0 | None |
oauth2-proxy Bitnami | All versions | 7.0.0 |
github.com/oauth2-proxy/oauth2-proxy/v7 Go | All versions | 7.0.0 |
github.com/oauth2-proxy/oauth2-proxy/v7 Go | All versions | 7.0.0 |
1 more packages
github.com/oauth2-proxy/oauth2-proxy/v7 Go | All versions | 7.0.0 |
Products include Oauth2 Proxy Project Oauth2 Proxy.
How do I fix CVE-2021-21291?
Upgrade to a fixed version.
Is CVE-2021-21291 being exploited?
There is no known exploitation of CVE-2021-21291 in the wild and no public exploit code.
Other vulnerabilities in oauth2-proxy
- CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
- CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
- CVE-2025-54576 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
- CVE-2017-1000069 Cross-site Request Forgery (CSRF)
- CVE-2026-41059 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
Sources
Also known as BIT-oauth2-proxy-2021-21291, GHSA-4mf2-f3wh-gvf2, GO-2022-0790.