EUVD-2026-65061
GHSA-vvqv-7vrf-88vh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-request header spoof over the network gives PR:N/AC:L/UI:N; the bypass exposes and can alter protected upstream resources (C:H/I:H) with no availability impact; scope kept U conservatively.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.
AnalysisAI
Authentication bypass in OAuth2 Proxy (versions 7.5.0 up to but excluding 7.15.2) lets an unauthenticated remote attacker reach protected upstream routes by spoofing the X-Forwarded-Uri header. Because the trusted-proxy IP set defaults to 0.0.0.0/0 (and ::/0) whenever --reverse-proxy is enabled without --trusted-proxy-ip, every client is treated as a trusted proxy, so the skip-auth allow list is matched against the attacker-controlled header value while the real protected path is passed to the upstream. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target OAuth2 Proxy to be running with --reverse-proxy enabled, at least one --skip_auth_routes or legacy --skip-auth-regex rule configured, and --trusted-proxy-ip left unset (so the trusted-proxy set defaults to 0.0.0.0/0 and ::/0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.3, Critical) reflects a network-reachable, unauthenticated bypass with high confidentiality and integrity impact, consistent with the advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker directly requests a protected upstream path (for example /admin) through OAuth2 Proxy while adding a header such as X-Forwarded-Uri: /public/health that matches an allow-listed skip_auth_route. OAuth2 Proxy trusts the header because the default trusted-proxy set is 0.0.0.0/0, evaluates the skip-auth decision against the spoofed value, and forwards the real protected path to the upstream unauthenticated. … |
| Remediation | Vendor-released patch: upgrade to OAuth2 Proxy 7.15.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all OAuth2 Proxy deployments to identify instances running versions 7.5.0 through 7.15.1 and document their current trusted-proxy configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Oauth2 Proxy
View allOAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remo
Authentication bypass in OAuth2 Proxy versions before 7.15.2 allows remote unauthenticated attackers to access protected
CSRF in Bitly oauth2_proxy 2.1 during authentication flow. Rated high severity (CVSS 8.8), this vulnerability is remotel
The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and te
In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerabil
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. Rated
In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to se
OAuth2 Proxy versions 7.11.0 through 7.15.1 fail to clear the session cookie when rendering the sign-in page due to a re
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today