OAuth2 Proxy versions before 7.15.2 allow a configuration-dependent authentication bypass when used in auth_request mode with either the --ping-user-agent or --gcp-healthchecks features enabled. The proxy treats any request bearing the specified health‑check User‑Agent string as a successful health check regardless of the requested path, effectively authenticating the client. An attacker who can send a request with that User‑Agent header to any upstream endpoint protected by the proxy can bypass authentication and obtain unauthorized access to the protected resource. The weakness is identified as CWE‑290 (Improper Restriction or Check for Validity of Authentication).

The affected product is oauth2-proxy:oauth2-proxy. Deployments using a version earlier than 7.15.2 in an auth_request‑style configuration that enable the health‑check User‑Agent matching via --ping-user-agent or the GCP health‑check mode are impacted. Configurations that do not use auth_request sub‑requests or do not enable these flags remain unaffected.

The CVSS score of 9.1 indicates a critical level of risk, reflecting remote authentication bypass that could allow unrestricted access to protected services. While EPSS data is not available and the vulnerability is not listed in the KEV catalog, the lack of a current exploit report does not diminish the severity of the flaw, as the bypass can be invoked simply by sending an HTTP request with the matching User‑Agent header. The attack vector is network‑based and does not require privileged client access; the attacker just needs to craft an HTTP request with the specific User‑Agent string used in health checks.