{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-25T01:17:09.762","vulnerabilities":[{"cve":{"id":"CVE-2026-34454","sourceIdentifier":"security-advisories@github.com","published":"2026-04-14T23:16:28.167","lastModified":"2026-06-17T10:39:04.690","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations or devices, a subsequent user could continue to use the previous user's authenticated session. Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected. This issue is fixed in 7.15.2"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"oauth2-proxy","product":"oauth2-proxy","versions":[{"version":">= 7.11.0, < 7.15.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-15T13:30:00.521921Z","id":"CVE-2026-34454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-384"},{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*","versionStartIncluding":"7.11.0","versionEndExcluding":"7.15.2","matchCriteriaId":"72445393-2EA7-4F64-BFA4-B6BAD74B21D8"}]}]}],"references":[{"url":"https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.2","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f","source":"security-advisories@github.com","tags":["Release Notes"]}]}}]}