Insufficient Session Expiration Affecting github.com/oauth2-proxy/oauth2-proxy/v7 package, versions >=7.11.0 <7.15.2

github.com/oauth2-proxy/oauth2-proxy/v7 is a reverse proxy that provides authentication with Google, Github or other providers.

Affected versions of this package are vulnerable to Insufficient Session Expiration through the SignInPage handler in oauthproxy.go. An attacker can keep a victim’s authenticated session cookie in place by sending the victim to the sign-in page, causing the proxy to render the login flow without clearing the existing session state. This leaves the user operating under a stale session and can preserve access tied to an account that should have been signed out, leading to unintended account access and session confusion.

Notes

• Deployments that use the dedicated logout/sign-out endpoint to terminate sessions are not affected; the issue is specific to flows that depend on the sign-in page itself to clear the browser session during logout.
• The regression is tied to releases from v7.11.0 through v7.15.1.

Workarounds

• Use the dedicated logout/sign-out endpoint of OAuth2 Proxy instead of relying on the SignInPage flow to end a session; this prevents the existing session cookie from remaining valid after logout.
• Make the application logout flow explicitly clear the OAuth2 Proxy session cookie before redirecting users to the sign-in page; this prevents a stale authenticated session from persisting.

• GitHub Commit
• GitHub Release
• Maintainer's Advisory