Impact
An Open Redirect vulnerability existed in the OAuth callback handler. The application trusted the X-Forwarded-Host header without validation when constructing the redirect URL after successful OAuth authentication.
An attacker could craft a malicious authentication link that, after the user successfully authenticates with their OAuth provider, redirects them to an attacker-controlled external site. This could be used for:
- Phishing attacks (redirecting to a fake login page to steal credentials)
- Malware distribution
- Token theft if combined with other vulnerabilities
Severity: Medium - Attackers could redirect authenticated users to malicious external sites.
Patches
This vulnerability has been patched in PR #3065.
The fix removes the special handling for X-Forwarded-Host and always uses the origin extracted from the request URL, which represents the actual domain the user visited.
Users of the hosted Onlook service are automatically protected once deployed. Self-hosted users should pull the latest changes from the main branch.
Workarounds
There are no workarounds. Users must upgrade to a patched version.
References
im-soohyun Reporter
Impact
An Open Redirect vulnerability existed in the OAuth callback handler. The application trusted the
X-Forwarded-Hostheader without validation when constructing the redirect URL after successful OAuth authentication.An attacker could craft a malicious authentication link that, after the user successfully authenticates with their OAuth provider, redirects them to an attacker-controlled external site. This could be used for:
Severity: Medium - Attackers could redirect authenticated users to malicious external sites.
Patches
This vulnerability has been patched in PR #3065.
The fix removes the special handling for
X-Forwarded-Hostand always uses theoriginextracted from the request URL, which represents the actual domain the user visited.Users of the hosted Onlook service are automatically protected once deployed. Self-hosted users should pull the latest changes from the main branch.
Workarounds
There are no workarounds. Users must upgrade to a patched version.
References