A regression introduced in OAuth2 Proxy 7.11.0 prevents the session cookie from being cleared when the sign‑in page is displayed as part of the logout flow. This means that after a user logs out, the browser may still retain the original session cookie and can continue to access protected resources. The consequence is that a subsequent user on the same workstation could gain unauthorized access to the previous user's session, effectively bypassing the logout action.

The issue affects deployments of OAuth2 Proxy using the oauth2-proxy product from 7.11.0 up to and including 7.15.1. The regression is fixed in version 7.15.2 and later.

The CVSS score of 3.5 indicates low severity, and there is no EPSS or KEV entry, meaning the vulnerability is not widely exploited at present. The likely attack vector is a local user on a shared workstation who logs out and then intends to log in again; because the cookie persists, the same authenticated session remains active. Remote exploitation is not required, and the flaw benefits only environments that rely on the sign‑in page as part of the logout process.