{"answers":{"affected":"5 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy/v7, oauth2-proxy and github.com/oauth2-proxy/oauth2-proxy. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-21411 in the wild and no public exploit code.","fix":"Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.1.0 or later.","what":"CVE-2021-21411 is a medium-severity missing authorization vulnerability in oauth2-proxy, published on 26 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-21411 and fix it if it is affected.\n\nWhat it is: CVE-2021-21411 is a medium-severity missing authorization vulnerability in oauth2-proxy, published on 26 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-21411 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected all versions; fixed in 7.1.0\n- github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected all versions; fixed in 7.1.0\n- github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected all versions; fixed in 7.1.0\n- oauth2-proxy (Bitnami): affected from 7.0.0; fixed in 7.1.0\n- github.com/oauth2-proxy/oauth2-proxy (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-21411/ (Markdown: https://insights.sbomify.com/CVE-2021-21411/index.md)","id":"CVE-2021-21411","markdown":"https://insights.sbomify.com/CVE-2021-21411/index.md","name":"CVE-2021-21411","record":{"aliases":["BIT-oauth2-proxy-2021-21411","GHSA-652x-m2gr-hppm","GO-2025-3832"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"OAuth2 reverse proxy","requires_auth":"high_privilege","summary":"Authenticated users bypass GitLab group restrictions in OAuth2-Proxy, accessing applications without proper authorization checks.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"oauth2_proxy","vendor":"oauth2_proxy_project"}],"cvss":{"score":5.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-Groups` header to the upstream application. While adding GitLab project based authorization support in #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group` config entries instead of pulling the individual user's group membership from the GitLab Userinfo endpoint. When the session groups where compared against the allowed groups for authorization, they matched improperly (since both lists were populated with the same data) so authorization was allowed. This impacts GitLab Provider users who relies on group membership for authorization restrictions. Any authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group` membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug. But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups; it is not broken.","ecosystems":["Bitnami","Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Incorrect authorization in OAuth2-Proxy","id":"CVE-2021-21411","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"missing_authorization","year":"2021"},"n_packages":5,"n_references":5,"next":{"headline":"[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values","id":"CVE-2021-21412"},"packages":[{"ecosystem":"Bitnami","fixed":["7.1.0"],"introduced":["7.0.0"],"last_affected":[],"package":"oauth2-proxy","purl":"pkg:bitnami/oauth2-proxy","source":"BIT-oauth2-proxy-2021-21411"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/oauth2-proxy/oauth2-proxy","purl":"pkg:golang/github.com/oauth2-proxy/oauth2-proxy","source":"GO-2025-3832"},{"ecosystem":"Go","fixed":["7.1.0"],"introduced":["0"],"last_affected":[],"package":"github.com/oauth2-proxy/oauth2-proxy/v7","purl":null,"source":"GHSA-652x-m2gr-hppm"},{"ecosystem":"Go","fixed":["7.1.0"],"introduced":["0"],"last_affected":[],"package":"github.com/oauth2-proxy/oauth2-proxy/v7","purl":"pkg:golang/github.com/oauth2-proxy/oauth2-proxy/v7","source":"GHSA-652x-m2gr-hppm"},{"ecosystem":"Go","fixed":["7.1.0"],"introduced":["0"],"last_affected":[],"package":"github.com/oauth2-proxy/oauth2-proxy/v7","purl":"pkg:golang/github.com/oauth2-proxy/oauth2-proxy/v7","source":"GO-2025-3832"}],"prev":{"headline":"Out-of-bounds read in the 6LoWPAN implementation","id":"CVE-2021-21410"},"products":["oauth2-proxy"],"published":"2021-03-26","related":[{"cvss_score":9.1,"headline":"OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing","id":"CVE-2026-40575","kev_date_added":null,"published":"2026-04-21"},{"cvss_score":9.1,"headline":"OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode","id":"CVE-2026-34457","kev_date_added":null,"published":"2026-04-14"},{"cvss_score":9.1,"headline":"OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion","id":"CVE-2025-54576","kev_date_added":null,"published":"2025-07-30"},{"cvss_score":8.8,"headline":"Cross-site Request Forgery (CSRF)","id":"CVE-2017-1000069","kev_date_added":null,"published":"2017-07-13"},{"cvss_score":8.2,"headline":"OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex","id":"CVE-2026-41059","kev_date_added":null,"published":"2026-04-21"},{"cvss_score":7.1,"headline":"Open Redirect in OAuth2 Proxy","id":"CVE-2020-11053","kev_date_added":null,"published":"2020-05-07"},{"cvss_score":6.8,"headline":"OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims","id":"CVE-2026-40574","kev_date_added":null,"published":"2026-04-21"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["oauth2-proxy"]},"summary":"Authenticated users bypass GitLab group restrictions in OAuth2-Proxy, accessing applications without proper authorization checks.","url":"https://insights.sbomify.com/CVE-2021-21411/"}