CVE-2023-27496

score

<0.1

cvss

6.5

epss

0.8%

published

2023-04-04

kev added

—

first seen

2026-10-21

Envoy versions prior to 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a vulnerability caused by the OAuth filter assuming the presence of a 'state' query parameter in OAuth redirect responses, leading to abnormal termination of Envoy process if the parameter is missing, exploit requires sending a request with the redirect URI path without 'state'.