CVE-2026-83589

MediumCVSS 6.1/10Last modified Oct 30, 2026

Description

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Container Platform 4.12	—
Red Hat	Red Hat OpenShift Container Platform 4.14	—
Red Hat	Red Hat OpenShift Container Platform 4.15	—
Red Hat	Red Hat OpenShift Container Platform 4.16	—
Red Hat	Red Hat OpenShift Container Platform 4.18	—
Red Hat	Red Hat OpenShift Container Platform 4.19	—
Red Hat	Red Hat OpenShift Container Platform 4.20	—
Red Hat	Red Hat OpenShift Container Platform 4.21	—
Red Hat	Red Hat OpenShift Container Platform 4.22	—
Red Hat	Red Hat OpenShift Container Platform 5	—

References

Timeline

Published: Oct 1, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-83597.5When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patt CVE-2026-835917.2The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Tr CVE-2026-835927.2The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versio CVE-2026-835937.2The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-835948.3Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceFie CVE-2026-835958.1AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing action CVE-2026-835968.8A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.CVE-2026-835977.0Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and CVE-2026-835987.8Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as S CVE-2026-835997.5Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate befo CVE-2026-83607.5Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can CVE-2026-836006.5Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2