GHSA-grh9-37g7-53mj json
WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow
published 9mo ago modified 9mo ago also GO-2026-4398
- cvss
- 6.1
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
### Summary An Open Redirect vulnerability exists in the OAuth authentication flow that allows attackers to redirect users to external malicious websites after authentication. The vulnerability is caused by insufficient validation of the return parameter in the OAuth login initialization endpoint.
### Patches The problem was fixed in the latest release, v2.1.2. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.
Patch / fix
- go github.com/h44z/wg-portal 2.1.2
Is GHSA-grh9-37g7-53mj in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/h44z/wg-portal | <2.1.2 all versions |
2.1.2 |
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
Sources
- GitHub Advisory GHSA-grh9-37g7-53mj
- OSV GO-2026-4398
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.