Skip to content
OpenAdvisories
Low · 3.5 CVE-2026-34454 BIT-oauth2-proxy-2026-34454EUVD-2026-22758GHSA-f24x-5g9q-753fGO-2026-5341

OAuth2 Proxy: Session cookie not cleared when rendering sign-in page

Published Apr 14, 2026 · Updated Apr 15, 2026 · Assigned by GitHub_M

Description

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations or devices, a subsequent user could continue to use the previous user's authenticated session. Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected. This issue is fixed in 7.15.2

Affected products

VendorProductAffectedFixed
oauth2-proxy oauth2-proxy >= 7.11.0, < 7.15.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/oauth2-proxy/oauth2-proxy all versions — GO-2026-5341
Go github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.11.0, < 7.15.2 7.15.2 GHSA-f24x-5g9q-753f

Advisories 1

References