Security flaws in an SSO plugin for Caddy

Published

2023-09-18 12:00

Collected

2026-07-03 03:55

---
id: 1620
title: "Security flaws in an SSO plugin for Caddy"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/"
published_at: "2023-09-18T12:00:42Z"
tags: ["cloud", "security-audit", "xss", "vulnerability", "sso", "oauth", "caddy"]
phying_url: "https://phying.com/item/1620"
lang: en
---

# Security flaws in an SSO plugin for Caddy

## Summary

Trail of Bits identified 10 vulnerabilities in Caddy's caddy-security SSO plugin, enabling reflected XSS, OAuth replay, 2FA brute-force bypass, open redirection, and unauthorized access.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2023-09-18T12:00:42Z
- **Original:** https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
- **Phying News:** https://phying.com/item/1620