Read the docs
TI-2026-29315 Aliases CVE-2026-40575GHSA-7x63-xv5r-3p2x

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

Priority MEDIUM 48CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-290.

Summary

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with `--reverse-proxy` enabled and configure at least one `--skip-auth-regex` or `--skip-auth-route` rule. This issue is patched in `v7.15.2`. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level; explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow `--skip-auth-regex` / `--skip-auth-route` rules where possible. For nginx-based deployments, ensure `X-Forwarded-Uri` is set by nginx and not passed through from the client.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00477 41st percentileScored 2026-11-07
Fix Partial oauth2-proxy (oauth2-proxy): 7.15.2github.com/oauth2-proxy/oauth2-proxy/v7 (Go): 7.15.2Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oauth2-proxyoauth2-proxy7.5.0 to before 7.15.27.15.2Patch availableCNA
—github.com/oauth2-proxy/oauth2-proxy/v7 (Go)7.5.0 to before 7.15.27.15.2Patch availableGHSA-7x63-xv5r-3p2x
  • oauth2-proxy Vendoroauth2-proxy Affected 7.5.0 to before 7.15.2 Fixed in 7.15.2 Patch available CNA
  • github.com/oauth2-proxy/oauth2-proxy/v7 (Go) Vendor— Affected 7.5.0 to before 7.15.2 Fixed in 7.15.2 Patch available GHSA-7x63-xv5r-3p2x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*7.5.0 to before 7.15.2Vulnerableoauth2-proxy
  • cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:* Versions 7.5.0 to before 7.15.2 Vulnerable ·oauth2-proxy

Remediation

  • Fix · CNA oauth2-proxy (oauth2-proxy) Fixed in 7.15.2
  • Fix · GHSA-7x63-xv5r-3p2x github.com/oauth2-proxy/oauth2-proxy/v7 (Go) Fixed in 7.15.2 Advisory →

Red Hat 1 advisory

  • RHSA-2026:58471 Released 2026-08-22 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images oauth2-proxy-7.15.4-0.1.hum1@aarch64, oauth2-proxy-7.15.4-0.1.hum1@src, oauth2-proxy-7.15.4-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:58471

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40575
  2. 2026-10-03 Alias added: GHSA-7x63-xv5r-3p2x
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 2

Other 4

  • TI-2025-34353 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion CVSS 3.1CRITICAL 9.1
  • TI-2026-26722 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CVSS 3.1CRITICAL 9.1
  • TI-2026-29698 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex CVSS 3.1HIGH 8.2
  • TI-2017-14408 CSRF in Bitly oauth2_proxy 2.1 during authentication flow CVSS 3.0HIGH 8.8
  • TI-2020-08927 Open Redirect in OAuth2 Proxy CVSS 3.1HIGH 7.1
  • TI-2026-29314 OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims CVSS 3.1MEDIUM 6.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences