GitHub Advisoryadvisory · Go

GHSA-2r2v-9pf8-6342 WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover

HIGH Published 2025-01-07 Modified 2025-01-07 Official page ↗

Ecosystem: Go
Packages: github.com/h44z/wg-portal
Severity: High
Reviewed: 2025-01-07

Affected packages

• Go github.com/h44z/wg-portal: >= 2.0.0-alpha.1, < 2.0.0-alpha.3 → fixed in 2.0.0-alpha.3

Description

Impact Users of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website. Patches The problem was fixed in the latest alpha release, v2.0.0-alpha.3. The docker images for the tag 'latest' built from the master branch also include the fix.

References

https://github.com/h44z/wg-portal/security/advisories/GHSA-2r2v-9pf8-6342 web
https://github.com/h44z/wg-portal/commit/62dbdfe0f96045d46e121d509fc181fbb7936895 web
https://github.com/h44z/wg-portal package