CVE-2026-76835

OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

Published Aug 24, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.

Analysis

Technical impact

The vulnerability causes OAuth2 Proxy to honor client‑supplied X‑Forwarded‑Uri headers when determining whether to skip authentication. In the default configuration the guard added for CVE‑2026‑40575 is inactive, and the trust check for forwarded headers falls back to a universal IP block (0.0.0.0/0 and ::/0). As a result, any client is treated as a trusted proxy and can set X‑Forwarded‑Uri to an allow‑listed path, leading the proxy to skip authentication for protected resources. This constitutes a serious Authentication Bypass that permits an unauthenticated attacker to access upstream services meant to be protected.

Affected Systems

OAuth2 Proxy versions 7.15.2 through 7.15.4 are affected. All installations that enable reverse proxy mode without a proper trusted_proxy_ip configuration are vulnerable.

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity. Although the EPSS score is not available, the vulnerability’s design—where every client is implicitly trusted—makes exploitation straightforward for any external user. The issue is not currently listed in the CISA KEV catalog, but the broad trust model raises its exploitability in real‑world deployments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

oauth2-proxy

unaffected

Version	Status	Constraints
`7.15.2`	affected	≤ 7.15.4

No data.

Vendor Product Versions

Oauth2 Proxy Project

Oauth2 Proxy

Version	Status	Scheme	Platform
`[7.15.2,7.15.4]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OAuth2 Proxy to version 7.15.5 or later, which eliminates the default trust of all IPs when reverse_proxy mode is enabled.
Configure the trusted_proxy_ip setting to include only known, internal proxy IPs, ensuring that no external hosts are trusted for forwarded headers.
If upgrade is not immediately possible, disable reverse_proxy mode or set reverse_proxy=false to revert to the stricter default behavior and prevent bypass attempts.

Generated by OpenCVE AI on August 24, 2026 at 20:30 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.453% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/oauth2-proxy/oauth2-proxy
https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/pkg/apis/middleware/scope.go
https://github.com/oauth2-proxy/oauth2-proxy/issues/3506
https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x
https://www.vulncheck.com/advisories/oauth2-proxy-through-authentication-bypass-via-x-forwarded-uri-under-the-default-trusted-proxy-set

History

Aug 24, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 6:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.
Title		OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
First Time appeared		Oauth2 Proxy Project Oauth2 Proxy Project oauth2 Proxy
Weaknesses		CWE-290
CPEs		cpe:2.3:a:oauth2_proxy_project:oauth2_proxy::::::::
Vendors & Products		Oauth2 Proxy Project Oauth2 Proxy Project oauth2 Proxy
References		https://github.com/oauth2-proxy/oauth2-proxy https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/pkg/apis/middleware/scope.go https://github.com/oauth2-proxy/oauth2-proxy/issues/3506 https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x https://www.vulncheck.com/advisories/oauth2-proxy-through-authentication-bypass-via-x-forwarded-uri-under-the-default-trusted-proxy-set
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`