{"id":"GHSA-2r2v-9pf8-6342","summary":"WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover","details":"### Impact\nUsers of WireGuard Portal v2 who have OAuth (or OIDC) authentication backends enabled can be affected by an Account Takeover vulnerability if they visit a malicious website.\n\n### Patches\nThe problem was fixed in the latest alpha release, v2.0.0-alpha.3. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.\n","aliases":["GO-2025-3371"],"modified":"2025-01-08T19:42:21.896344Z","published":"2025-01-07T15:52:16Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-01-07T15:52:16Z","nvd_published_at":null,"cwe_ids":[],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/h44z/wg-portal/security/advisories/GHSA-2r2v-9pf8-6342"},{"type":"WEB","url":"https://github.com/h44z/wg-portal/commit/62dbdfe0f96045d46e121d509fc181fbb7936895"},{"type":"PACKAGE","url":"https://github.com/h44z/wg-portal"}],"affected":[{"package":{"name":"github.com/h44z/wg-portal","ecosystem":"Go","purl":"pkg:golang/github.com/h44z/wg-portal"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-alpha.1"},{"fixed":"2.0.0-alpha.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-2r2v-9pf8-6342/GHSA-2r2v-9pf8-6342.json"}}],"schema_version":"1.9.0"}