Authentication bypass via X-Forwarded-Uri header spoofing in OAuth2 Proxy (CVE-2026-40575)

OAuth2 Proxy trusts a client-supplied X-Forwarded-Uri header when configured with --reverse-proxy and at least one --skip-auth-route or --skip-auth-regex rule. An attacker can spoof this header to cause OAuth2 Proxy to evaluate authentication and skip-auth rules against an arbitrary path, while the upstream application receives the actual request path. This allows an unauthenticated remote attacker to bypass authentication and access protected routes without a valid session. Affected versions: - >= 7.5.0 && < 7.15.2 We recommend updating to: > 7.15.1. CVSS 9.1 · our assessment: act_now Reference: https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x Details: https://vuln.today/cve/CVE-2026-40575