An authentication and authorization bypass flaw exists in the NGINX Ingress Controller when it is configured with the ExternalAuth policy. Untrusted clients can supply X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers that are forwarded unsanitized into an internal authentication subrequest handled by the NGINX auth_request directive. As a result, an attacker who does not possess valid credentials may cause the external authentication provider to evaluate those spoofed request attributes, allowing the attacker to access protected paths. The weakness corresponds to CWE‑290: Improper Authentication.

The vulnerability affects F5's NGINX Ingress Controller. No specific version information is listed by the CNA, and the vulnerability is a data‑plane issue only; there is no control‑plane exposure.

The flaw carries a CVSS score of 8.7, indicating high severity, and it is not listed in the CISA KEV catalog. The EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation, meaning the public risk of exploitation is low, yet the high CVSS suggests potential for significant impact if the attacker can reach the data plane with the required header manipulation. The likely attack vector is remote over the network, inferred from the description that a remote attacker can supply HTTP headers to the ingress controller.