NGINX Ingress Controller incorrectly processes an HTTP response from an OAuth identity policy is active, allowing an attacker to bypass authentication and reach protected routes—thereby enabling remote unauthenticated access to sensitive resources.

The vulnerability applies to the NGINX Ingress Controller from F5 that implements an externalAuth policy. Specific version information is not listed; therefore any deployment using this policy is potentially affected until a patch is applied or the policy is removed.

The CVSS score of 8.7 categorizes the issue as high severity. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by delivering a crafted OAuth response; the issue resides in the data plane and does not expose the control plane.