CVE-2021-21291: 
Homebrew vulnerability analysis and mitigation

A vulnerability was discovered in OAuth2-Proxy's whitelist domain feature (CVE-2021-21291). The issue affected versions 3.0.0 through 6.1.1 and was patched in version 7.0.0. The vulnerability allowed unintended redirects through improper subdomain validation, where domains that ended similarly to the intended domain could be allowed as valid redirects (GitHub Advisory).

The vulnerability stemmed from incorrect subdomain validation logic in the whitelist domain feature. When a whitelist domain was configured with a leading dot (e.g., .example.com), the code would incorrectly match not only intended subdomains but also unrelated domains that ended with the same string. For example, if .example.com was whitelisted, both legitimate-subdomain.example.com and malicious-site.badexample.com would be considered valid redirects (GitHub Advisory).

For users utilizing the whitelist domain feature, the vulnerability could allow attackers to redirect users to unintended and potentially malicious domains that shared a suffix with the legitimate whitelisted domain. This could lead to phishing attacks or other malicious redirects (GitHub Advisory).

The vulnerability was considered moderately exploitable. An attacker could exploit this by crafting a domain name that ended with the same string as a whitelisted domain, potentially leading to unauthorized redirects (GitHub Advisory).

The issue was patched in OAuth2-Proxy version 7.0.0. Users are strongly recommended to upgrade to this version or later. As a temporary workaround, users can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain (GitHub Advisory).