Release Highlights 🔵 Golang version upgrade to v1.26.4 Upgrade of all dependencies to their latest versions 🕵️♀️ Vulnerabilities have ben addressed CVE-2026-33811 CVE-2026-33814 CVE-2026-39820 CVE-2026-39836 CVE-2026-42499 CVE-2026-42504 CVE-2026-39823 CVE-2026-39826 CVE-2026-39825 CVE-2026-27145 CVE-2026-42507 Important Notes Breaking Changes Changes since v7.15.2 #3477 chore(dep): bump go to 1.…
Release Highlights 🔵 Golang version upgrade to v1.25.9 Upgrade of all dependencies to their latest versions CVE-2026-34986 CVE-2026-32281 CVE-2026-32289 CVE-2026-32288 CVE-2026-32280 CVE-2026-32282 CVE-2026-32283 🕵️♀️ Vulnerabilities have been addressed Important Notes We have had security audits performed on OAuth2 Proxy in the past couple of weeks and as a result we have fixed several CRITICAL…
Release Highlights 🐛 Squashed some bugs 🕵️♀️ Vulnerabilities have been addressed CVE-2026-33186 OAuth2 Proxy was not impacted by this vulnerability as it isn't in the path of execution Important Notes Breaking Changes Changes since v7.15.0 #3382 chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit) #3374 fix: handle Unix socket RemoteAddr in IP resolution (@H1net) #3381 fix: d…
Release Highlights 🔒 OIDC JWT signing algorithms can now be configured 🍪 CSRF cookie improvements (SameSite option, proper expiration validation) 🧪 Configuration validation flag: --config-test 🔌 Unix socket file mode support 👤 Session state can now be extend with arbitrary claims from ID Token and upstream IDP user profiles endpoint This opens the door for multiple features like: Additional arbitr…
Release Highlights 🔵 Go1.25.7 and upgrade of dependencies to latest versions (@tuunit) Fixes CVE-2025-68121 🐛 Bug fixes Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. Important Notes We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workfl…
Release Highlights Revert AuthOnly endpoint change from v7.14.1 that caused issues when using skip-provider-button enabled Important Notes This release reverts the change made in v7.14.1 that caused issues when using the skip-provider-button enabled. Now, when a session does not exist, the AuthOnly endpoint will send a 401 status code as expected instead of a 302 redirect. And instead we extended…
Release Highlights 🔵 Go1.25.6 and upgrade of dependencies to latest versions 🐛 Bug fixes AuthOnly now starts the auth flow and send status code 302 if no session exists and skip-provider-button is true Fixed static upstream validation issue due to incorrect defaults Important Notes Excerpt from v7.14.0 release letter. https://github.com/oauth2-proxy/oauth2-proxy/releases/v7.14.0 This release intro…
Release Highlights 🕵️♀️ Vulnerabilities have been addressed CVE-2025-61729 CVE-2025-61727 CVE-2025-47914 CVE-2025-58181 🗂️ Major Alpha Config YAML parsing revamped for better extensibility and preparing v8 🐛 Squashed some bugs Important Notes This release introduces a breaking change for Alpha Config users and moves us significantly closer to removing legacy configuration parameters, making the c…
Release Highlights 🕵️♀️ Vulnerabilities have been addressd CVE-2025-47912 CVE-2025-58183 CVE-2025-58186 CVE-2025-64484 🐛 Squashed some bugs Important Notes By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both X-Forwarded-For and X_Forwarded-…
Release Highlights 🕵️♀️ Vulnerabilities have been addressed CVE-2025-47907 🦸 Support for Cidaas IDP 🐛 Squashed some bugs Important Notes Breaking Changes Changes since v7.11.0 #2273 feat: add Cidaas provider (@Bibob7, @Teko012) #3166 chore(dep): upgrade to latest golang 1.24.6 (@tuunit) #3156 feat: allow disable-keep-alives configuration for upstream (@jet-go) #3150 fix: Gitea team membership (@M…