OAuth2 Proxy Vulnerability: Authentication Bypass Risk
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- oauth2-proxy (go)
- Affected versions
- >= v7.15.4, <= v7.15.4 or >= v7.15.3, <= v7.15.3 or >= v7.15.2, <= v7.15.2
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in OAuth2 Proxy that may allow an unauthenticated attacker to bypass authentication. This affects the default reverse-proxy configuration.
What happened
An early warning has been issued for a critical vulnerability in OAuth2 Proxy. The vulnerability, tracked as CVE-2026-76835, allows an unauthenticated attacker to bypass authentication by supplying a malicious X-Forwarded-Uri header. This occurs because the OAuth2 Proxy, in its default reverse-proxy configuration, honours this header when deciding whether a request may skip authentication. The vulnerability affects versions 7.15.4, 7.15.3, and 7.15.2 of oauth2-proxy (go).
The issue arises from the way OAuth2 Proxy handles the X-Forwarded-Uri header. Specifically, the GetRequestURI function in pkg/requests/util/util.go prefers the X-Forwarded-Uri header over the actual request URI when CanTrustForwardedHeaders returns true. The isAllowedPath function in oauthproxy.go then matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. The CanTrustForwardedHeaders function in pkg/apis/middleware/scope.go grants trust to the header when the caller's address is in the trusted proxy set, which by default includes all addresses (0.0.0.0/0 and ::/0) when reverse proxy mode is enabled without a trusted_proxy_ip configured.
What to do about it
- Upgrade to the latest version of oauth2-proxy that patches this vulnerability.
- Review and restrict the use of the X-Forwarded-Uri header in your configuration.
- Ensure that trusted_proxy_ip is properly configured to limit which addresses are treated as trusted proxies.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
How 0Day would have caught this
oauth2-proxy is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using oauth2-proxy (go) versions 7.15.4, 7.15.3, or 7.15.2 in a default reverse-proxy configuration.
What should I do right now?
Upgrade to the latest version of oauth2-proxy, review and restrict the use of the X-Forwarded-Uri header, and ensure that trusted_proxy_ip is properly configured.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.