{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/h44z/wg-portal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T21:16:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn Open Redirect vulnerability exists in the OAuth authentication flow that allows attackers to redirect users to external malicious websites after authentication. The vulnerability is caused by insufficient validation of the return parameter in the OAuth login initialization endpoint.\n\n### Patches\nThe problem was fixed in the latest release, v2.1.2. The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag \u0027latest\u0027 built from the master branch also include the fix.",
  "id": "GHSA-grh9-37g7-53mj",
  "modified": "2026-02-02T21:16:49Z",
  "published": "2026-02-02T21:16:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/h44z/wg-portal/security/advisories/GHSA-grh9-37g7-53mj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h44z/wg-portal/commit/e62db0d62ebabbec39c767b953b92fb4b4d08a81"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/h44z/wg-portal"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h44z/wg-portal/releases/tag/v2.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow"
}