CVE-2021-21411 Incorrect authorization in OAuth2-Proxy

What is CVE-2021-21411?

CVE-2021-21411 is a medium-severity missing authorization vulnerability in oauth2-proxy, published on 26 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-Groups` header to the upstream application. While adding GitLab project based authorization support in #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group` config entries instead of pulling the individual user's group membership from the GitLab Userinfo endpoint. When the session groups where compared against the allowed groups for authorization, they matched improperly (since both lists were populated with the same data) so authorization was allowed. This impacts GitLab Provider users who relies on group membership for authorization restrictions. Any authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group` membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug. But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups; it is not broken.

Weakness: CWE-863

Which versions are affected by CVE-2021-21411?

5 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy/v7, oauth2-proxy and github.com/oauth2-proxy/oauth2-proxy. It affects 1 product.

Products include Oauth2 Proxy Project Oauth2 Proxy.

How do I fix CVE-2021-21411?

Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.1.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-21411 being exploited?

There is no known exploitation of CVE-2021-21411 in the wild and no public exploit code.

Other vulnerabilities in oauth2-proxy

• CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing Critical 9.1
• CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode Critical 9.1
• CVE-2025-54576 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion Critical 9.1
• CVE-2017-1000069 Cross-site Request Forgery (CSRF) High 8.8
• CVE-2026-41059 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-oauth2-proxy-2021-21411, GHSA-652x-m2gr-hppm, GO-2025-3832.