CVE-2026-34454
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A regression introduced in OAuth2 Proxy 7.11.0 prevents clearing the session cookie when rendering the sign-in page. In deployments relying on the sign-in page as part of the logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations, a subsequent user could continue the previous user's authenticated session. This is fixed in version 7.15.2.
Risk Assessment
The organization is at risk of unauthorized session access on shared devices, potentially leading to data confidentiality breaches and account takeover.
Recommendation
Update OAuth2 Proxy to version 7.15.2 or later to fix this regression.
Original NVD description (English source)
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations or devices, a subsequent user could continue to use the previous user's authenticated session. Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected. This issue is fixed in 7.15.2