A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
References
Configurations
No configuration.
History
29 Oct 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Oct 2026, 06:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Oct 2026, 06:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Oct 2026, 00:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Oct 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Oct 2026, 10:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-01 10:17
Updated : 2026-10-30 05:16
NVD link : CVE-2026-83589
Mitre link : CVE-2026-83589
CVE.ORG link : CVE-2026-83589
JSON object : View
Products Affected
No product.
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')