Vulnerability · Published Apr 14, 2026 · Assigned by GitHub_M
CVE-2026-34454OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
Low 3.5
In plain English
A low-severity session fixation in oauth2-proxy from oauth2-proxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations or devices, a subsequent user could continue to use the previous user's authenticated session. Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected. This issue is fixed in 7.15.2
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/oauth2-proxy/oauth2-proxy | no fix listed | GO-2026-5341 |
| Go | github.com/oauth2-proxy/oauth2-proxy/v7 | 7.15.2 | GHSA-f24x-5g9q-753f |
| Go | github.com/oauth2-proxy/oauth2-proxy/v7 | 7.15.2 | GO-2026-5341 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| oauth2-proxy | oauth2-proxy | >= 7.11.0, < 7.15.2 |
Weakness: CWE-613, CWE-384 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N