Description
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations or devices, a subsequent user could continue to use the previous user's authenticated session. Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected. This issue is fixed in 7.15.2
INFO
Published Date :
2026-04-14T22:10:37.901Z
Last Modified :
2026-04-15T13:30:10.300Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-34454 vulnerability.
| Vendors | Products |
|---|---|
| Oauth2 Proxy Project |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-34454.
