Description (CNA)
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat OpenShift Container Platform 4.14 | unaffected 1791837363 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.15 | unaffected 1791632336 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.18 | unaffected 1790882320 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.19 | unaffected 1790807096 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.20 | unaffected 1790704224 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.21 | unaffected 1790706478 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.22 | unaffected 1790724885 before * |
CWE
CWE-601
References
- https://access.redhat.com/errata/RHSA-2026:74380
- https://access.redhat.com/errata/RHSA-2026:74383
- https://access.redhat.com/errata/RHSA-2026:74429
- https://access.redhat.com/errata/RHSA-2026:79039
- https://access.redhat.com/errata/RHSA-2026:79169
- https://access.redhat.com/errata/RHSA-2026:82785
- https://access.redhat.com/errata/RHSA-2026:82813
- https://access.redhat.com/security/cve/CVE-2026-83589
- https://bugzilla.redhat.com/show_bug.cgi?id=2518379
ADP enrichment
No English description supplied.
No references supplied.