CVE-2020-5233

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
pusher	OAuth2 Proxy	< 5.0.0

References

https://github.com/pusher/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2Patch, Third Party Advisory
https://github.com/pusher/oauth2_proxy/releases/tag/v5.0.0Release Notes, Third Party Advisory
https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gvExploit, Patch, Third Party Advisory
https://github.com/pusher/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2Patch, Third Party Advisory
https://github.com/pusher/oauth2_proxy/releases/tag/v5.0.0Release Notes, Third Party Advisory
https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gvExploit, Patch, Third Party Advisory

Timeline

Published: Jan 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52346.5MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash co CVE-2020-52359.8There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PB_ENA CVE-2020-52366.5Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header:CVE-2020-52378.8Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy,CVE-2020-52386.5The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could c CVE-2020-52398.8In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu ins CVE-2020-52408.5In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The u CVE-2020-52415.4matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.CVE-2020-52428.8openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitr CVE-2020-52437.5uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to CVE-2020-52447.5In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not n CVE-2020-52458.8Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard