{"id":"GHSA-2r2v-9pf8-6342","aliases":["GO-2025-3371"],"url":"https://o3.security/vulnerability/GHSA-2r2v-9pf8-6342","summary":"WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover","details":"### Impact\nUsers of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.\n\n### Patches\nThe problem was fixed in the latest alpha release, v2.0.0-alpha.3. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.\n","published":"2025-01-07T15:52:16Z","modified":"2025-01-08T19:42:21.896344Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/h44z/wg-portal","fixedVersion":"2.0.0-alpha.3"}],"fix":{"url":"https://github.com/h44z/wg-portal/commit/62dbdfe0f96045d46e121d509fc181fbb7936895","label":"h44z/wg-portal@62dbdfe"},"references":[{"type":"WEB","url":"https://github.com/h44z/wg-portal/security/advisories/GHSA-2r2v-9pf8-6342"},{"type":"WEB","url":"https://github.com/h44z/wg-portal/commit/62dbdfe0f96045d46e121d509fc181fbb7936895"},{"type":"PACKAGE","url":"https://github.com/h44z/wg-portal"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-01-08T19:42:21.896344Z"}}