OAuth2 Proxy EUVD-2026-65061

Exploitation requires the target OAuth2 Proxy to be running with --reverse-proxy enabled, at least one --skip_auth_routes or legacy --skip-auth-regex rule configured, and --trusted-proxy-ip left unset (so the trusted-proxy set defaults to 0.0.0.0/0 and ::/0). The attacker must be able to send HTTP requests directly to OAuth2 Proxy and must know or guess an allow-listed path to place in the X-Forwarded-Uri header. Limiting factors: if trusted_proxy_ip is explicitly configured to the real proxy CIDRs, if no skip-auth rules exist, or if the fronting load balancer already strips or overwrites X-Forwarded-Uri, the bypass does not work; no authentication or user interaction is required against a vulnerable configuration.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.3, Critical) reflects a network-reachable, unauthenticated bypass with high confidentiality and integrity impact, consistent with the advisory. However, the raw score understates the deployment gating: exploitation only works when --reverse-proxy is enabled AND at least one --skip_auth_routes / --skip-auth-regex rule exists AND --trusted-proxy-ip is left unset. These are common-but-not-universal conditions, so real-world exposure is narrower than an unconditional 9.3 implies. No EPSS score, KEV listing, or public POC was provided; this is a disclosure with a vendor patch rather than evidence of active exploitation, so treat it as a high-priority patch for affected deployments rather than an in-the-wild emergency. The signals are internally consistent (network vector matches an HTTP header-spoofing bug); the main caveat is the configuration dependency, which defenders must verify against their own deployment.

An attacker directly requests a protected upstream path (for example /admin) through OAuth2 Proxy while adding a header such as X-Forwarded-Uri: /public/health that matches an allow-listed skip_auth_route. OAuth2 Proxy trusts the header because the default trusted-proxy set is 0.0.0.0/0, evaluates the skip-auth decision against the spoofed value, and forwards the real protected path to the upstream unauthenticated. No exploit code has been published, but the attack is a trivial single crafted HTTP request given AV:N/AC:L/PR:N.