The vulnerability arises because the OAuth2 HTTP filter in Envoy decrypts cookies using AES‑256‑CBC without any authentication tag. When the /callback endpoint receives a failed decryption, it returns HTTP 302 for success and HTTP 401 for a padding failure, giving an attacker a padding oracle. An adversary who can obtain the encrypted CodeVerifier cookie can recover the plaintext PKCE code_verifier in roughly 6,200 decryption attempts, which can then be combined with a stolen authorization code to obtain the victim's access token. This effectively allows the attacker to forge authenticated sessions and hijack user accounts.

Envoy proxy servers running any version prior to 1.35.11, 1.36.7, 1.37.3, or 1.38.1 are vulnerable. The exposed bug resides in the OAuth2 HTTP filter component of the envoyproxy:envoy product.

The CVSS score of 6.8 indicates the vulnerability is of medium severity. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the attack can be carried out with a modest number of requests (around 6,200). An attacker who has access to the OAuth callback flow and can capture the encrypted cookie can exploit the padding oracle to retrieve the PKCE code_verifier, effectively compromising the target’s authentication tokens.