A flaw in OpenShift’s OAuth proxy causes it to set authenticated identity headers only using the dash‑variant (X-Forwarded-User) but it fails to strip the underscore‑variant (X_Forwarded_User) from client requests. Because WSGI and PHP frameworks normalize both header forms to the same internal variable, a logged‑in user can insert a forged underscore header that overrides the legitimate identity forwarded to the upstream application. The result is the ability to impersonate any other user, granting unauthorized access or privileged actions. The weakness is a classic header injection issue, categorized as CWE-436.

The vulnerability affects Red Hat OpenShift Container Platform 4. The advisory does not list affected patch levels, so any installation of OpenShift 4 that uses the built‑in oauth-proxy may be susceptible until a proper fix is deployed. The CPE identifier cpe:/a:redhat:openshift:4 confirms the scope.

The CVSS score of 8.5 indicates a high severity flaw, while the EPSS score of <1% suggests a low probability of exploitation in production environments. The vulnerability is not yet catalogued in CISA’s KEV list. Attackers need only a low‑privilege authenticated session to craft HTTP requests containing the underscore‑variant header; the overwrite occurs only for requests that traverse the OAuth proxy to a downstream WSGI or PHP application, so the risk is limited to that specific traffic. Based on the description, it is inferred that the attacker must target traffic that passes through the OAuth proxy to achieve the identity hijack. Because the attack relies on header normalization, it is relatively easy to automate but can be mitigated by upstream application hardening.