Description
### Impact
Users of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.
### Patches
The problem was fixed in the latest alpha release, v2.0.0-alpha.3. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/h44z/wg-portal | >= 2.0.0-alpha.1, < 2.0.0-alpha.3 | 2.0.0-alpha.3 | GHSA-2r2v-9pf8-6342 |
| Go | github.com/h44z/wg-portal | all versions | — | GO-2025-3371 |