Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations or devices, a subsequent user could continue to use the previous user's authenticated session. Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected. This issue is fixed in 7.15.2
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34454 OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session… https://www.cve.org/CVERecord?id=CVE-2026-34454
Post summary
The statement warns of a regression in OAuth2 Proxy (v7.11.0) that stops session cleanup, but it provides no PoC, exploit, active usage, patch, or debunking information.
CVE-2026-34454 Session Cookie Persistence Vulnerability in OAuth2 Proxy 7.11.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34454
Post summary
The text announces CVE-2026-34454 as a session cookie persistence issue in OAuth2 Proxy 7.11.0, providing basic technical details but no exploit or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | oauth2_proxy_project | oauth2_proxy | - | - | - |