h44z/wg-portal · Security
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover
- GHSA ID
- GHSA-2r2v-9pf8-6342
- Severity
- high
- Published
- Updated
Description
Impact
Users of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.
Patches
The problem was fixed in the latest alpha release, v2.0.0-alpha.3. The docker images for the tag 'latest' built from the master branch also include the fix.