CVE-2026-83589
A flaw was found in oauth-proxy.
Published Oct 1, 2026 · updated Oct 15, 2026 · Red Hat Red Hat OpenShift Container Platform 4.19
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter ( ) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
Timeline
Detection, updates, and resolution for this record.
Oct 1, 2026 · NIST NVD
Detected
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter ( ) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing
Oct 15, 2026 · NIST NVD
Updated
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter ( ) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing
Affected
- vendor Red Hat Red Hat OpenShift Container Platform 4version unspecified
- vendor Red Hat Red Hat OpenShift Container Platform 4.19version unspecified
- vendor Red Hat Red Hat OpenShift Container Platform 4.20version unspecified
- vendor Red Hat Red Hat OpenShift Container Platform 4.21version unspecified
- vendor Red Hat Red Hat OpenShift Container Platform 4.22version unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-83589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter ( ) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being re
vulnerability.circl.lu - CVE.orgCVE-2026-83589
Official CVE identifier
cve.org - NIST NVDCVE-2026-83589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter ( ) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being
nvd.nist.gov