Medium severity · published Jan 30, 2020
CVE-2020-5233
OAuth2 Proxy before 5.0 has an open redirect vulnerability
6.1
CVSS
1.3%
EPSS
No
On KEV
Description
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Oauth2 Proxy · Oauth2 Proxy Project
before 5.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5233
Patch
https://github.com/pusher/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2
Release Notes
https://github.com/pusher/oauth2_proxy/releases/tag/v5.0.0
Exploit
https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv
More from Oauth2 Proxy
9.1
CVE-2026-40575
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
9.1
CVE-2026-34457
OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
9.1
CVE-2025-54576
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
8.8
CVE-2017-1000069
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
8.2
CVE-2026-41059
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex