# CVE-2021-21411: Incorrect authorization in OAuth2-Proxy > Authenticated users bypass GitLab group restrictions in OAuth2-Proxy, accessing applications without proper authorization checks. - **Severity:** Medium 5.5 (`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N`) - **Exploited in the wild:** Not known - **Login needed:** An administrator - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 26 Mar 2021 - **Updated:** 3 Aug 2024 - **Also known as:** BIT-oauth2-proxy-2021-21411, GHSA-652x-m2gr-hppm, GO-2025-3832 ## What is CVE-2021-21411? CVE-2021-21411 is a medium-severity missing authorization vulnerability in oauth2-proxy, published on 26 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim. ### Official description OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-Groups` header to the upstream application. While adding GitLab project based authorization support in #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group` config entries instead of pulling the individual user's group membership from the GitLab Userinfo endpoint. When the session groups where compared against the allowed groups for authorization, they matched improperly (since both lists were populated with the same data) so authorization was allowed. This impacts GitLab Provider users who relies on group membership for authorization restrictions. Any authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group` membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug. But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups; it is not broken. Weakness: CWE-863 (Incorrect Authorization) ## Which versions are affected by CVE-2021-21411? 5 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy/v7, oauth2-proxy and github.com/oauth2-proxy/oauth2-proxy. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `github.com/oauth2-proxy/oauth2-proxy/v7` | Go | All versions | 7.1.0 | | `github.com/oauth2-proxy/oauth2-proxy/v7` | Go | All versions | 7.1.0 | | `github.com/oauth2-proxy/oauth2-proxy/v7` | Go | All versions | 7.1.0 | | `oauth2-proxy` | Bitnami | From 7.0.0 | 7.1.0 | | `github.com/oauth2-proxy/oauth2-proxy` | Go | All versions | None | Products: Oauth2 Proxy Project Oauth2 Proxy. ## How do I fix CVE-2021-21411? Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.1.0 or later. ## Is CVE-2021-21411 being exploited? There is no known exploitation of CVE-2021-21411 in the wild and no public exploit code. ## Other vulnerabilities in oauth2-proxy - [CVE-2026-40575](https://insights.sbomify.com/CVE-2026-40575/): OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing (critical 9.1) - [CVE-2026-34457](https://insights.sbomify.com/CVE-2026-34457/): OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode (critical 9.1) - [CVE-2025-54576](https://insights.sbomify.com/CVE-2025-54576/): OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion (critical 9.1) - [CVE-2017-1000069](https://insights.sbomify.com/CVE-2017-1000069/): Cross-site Request Forgery (CSRF) (high 8.8) - [CVE-2026-41059](https://insights.sbomify.com/CVE-2026-41059/): OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex (high 8.2) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2021-21411 and fix it if it is affected. What it is: CVE-2021-21411 is a medium-severity missing authorization vulnerability in oauth2-proxy, published on 26 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim. Exploitation: There is no known exploitation of CVE-2021-21411 in the wild and no public exploit code. Affected packages and fixed versions: - github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected all versions; fixed in 7.1.0 - github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected all versions; fixed in 7.1.0 - github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected all versions; fixed in 7.1.0 - oauth2-proxy (Bitnami): affected from 7.0.0; fixed in 7.1.0 - github.com/oauth2-proxy/oauth2-proxy (Go): affected all versions; no fix listed Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2021-21411/ (Markdown: https://insights.sbomify.com/CVE-2021-21411/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2021-21411 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-21411 - OSV: https://osv.dev/vulnerability/CVE-2021-21411 --- From sbomify Insights: https://insights.sbomify.com/CVE-2021-21411/ Summaries are generated and may contain mistakes; the official description above is the record.