oauth2-proxy releases

Upgrade now

v7.15.3 Breaking risk · 1mo

Dependencies

Golang upgrade + dependency bumps + CVE fixes

Open

v7.15.2 Security relevant patches GHSA-5hvv-m4w4-gf6v · 3mo

Security fixes

• CVE-2026-34986, CVE-2026-32281, CVE-2026-32289, CVE-2026-32288, CVE-2026-32280, CVE-2026-32282, CVE-2026-32283
• GHSA-5hvv-m4w4-gf6v: Health check user-agent authentication bypass (Critical)
• GHSA-7x63-xv5r-3p2x: X-Forwarded-Uri header spoofing authentication bypass (Critical)

Notable features

• New --trusted-proxy-ip flag for explicit trusted reverse proxy IP configuration

View release on GitHub

v7.15.1 Bug fix · 4mo

Fixed bugs in Unix socket handling for IP resolution, improved session refresh token logging, and corrected backend logout response handling.

View release on GitHub

v7.15.0 Breaking risk · 4mo

Breaking changes

• CSRF cookie validation now uses CSRFExpire instead of Expire

Notable features

• OIDC JWT signing algorithm configuration
• CSRF cookie SameSite option
• Config validation flag

View release on GitHub

v7.14.3 Security relevant · 5mo

Security fixes

• CVE-2025-68121

Notable features

• Redis URL parameter configuration

View release on GitHub

v7.14.2 Bug fix · 6mo

Reverted AuthOnly endpoint change that incorrectly returned 302 redirects, restoring 401 status when no session exists. Documentation improved for nginx auth_request configuration.

View release on GitHub

v7.14.1 Bug fix · 6mo

Fixed AuthOnly endpoint to properly handle 302 redirects when skip-provider-button is enabled, and corrected static upstream validation defaults.

View release on GitHub

v7.14.0 Security relevant · 6mo

Breaking changes

• Alpha Config: header injection sources must be explicitly nested (claimSource/secretSource)

Security fixes

• CVE-2025-61729
• CVE-2025-61727
• CVE-2025-47914

Notable features

• Alpha Config now supports Server struct configuration via YAML

View release on GitHub