The flaw allows an unauthenticated attacker to inject forged identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) on paths that bypass authentication. This can cause the upstream application to believe the request originates from a legitimate authenticated user, potentially leading to unauthorized actions or privilege escalation. The underlying weakness is the failure to strip these headers, allowing identity spoofing.

Red Hat OpenShift Container Platform 4, the currently deployed OpenShift Container Platform 4 releases that use openshift/oauth-proxy with skip-auth-regex enabled. No specific sub‑versions are listed, so any 4.x deployment that relies on the default proxy configuration is potentially affected.

The CVSS score of 6.5 indicates moderate severity. The exploit probability (EPSS) is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the issue via normal HTTP traffic to whitelisted paths, and no privileged access or elevated privileges are required. The vulnerability is likely to be exploitable through simple crafted requests, making it a practical risk to deployments that have permissive skip-auth-regex settings.