OAuth2 Proxy may accept a client‑supplied X-Forwarded-Uri header when reverse proxy mode is enabled and skip‑auth rules are active. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip‑auth logic against a different path than the one actually sent to the upstream application, resulting in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.

Versions 7.5.0 through 7.15.1 of the oauth2‑proxy project that run with the --reverse-proxy flag and define at least one --skip-auth-regex or --skip-auth-route rule are affected. Deployments using these settings are at risk.

The vulnerability carries a CVSS score of 9.1, indicating a high severity authentication bypass. No EPSS score is currently available, but the absence of a KEV listing does not reduce the risk; attackers who can reach the proxy instance can send crafted HTTP requests to manipulate the X-Forwarded-Uri header, escalating privilege and accessing restricted content. Exploitation requires only the ability to send requests to OAuth2 Proxy, which is common in web‑based deployments.