GitHub Advisoryadvisory · Go

GHSA-grh9-37g7-53mj WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow

MEDIUM Published 2026-02-02 Modified 2026-02-02 Official page ↗
Ecosystem
Go
Packages
github.com/h44z/wg-portal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-02-02

Affected packages

• Go github.com/h44z/wg-portal: < 2.1.2 → fixed in 2.1.2

Description

Summary An Open Redirect vulnerability exists in the OAuth authentication flow that allows attackers to redirect users to external malicious websites after authentication. The vulnerability is caused by insufficient validation of the return parameter in the OAuth login initialization endpoint. Patches The problem was fixed in the latest release, v2.1.2. The docker images for the tag 'latest' built from the master branch also include the fix.

Related

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References