OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
### Impact A configuration-dependent authentication bypass exists in OAuth2 Proxy. Deployments are affected when all of the following are true: * OAuth2 Proxy is configured with `--reverse-proxy` * and at least one rule is defined with `--skip_auth_routes` or the legacy `--skip-auth-regex` OAuth2 Proxy may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-route` or `--skip-auth-regex` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. ### Patches This issue is addressed as part of the newly introduced `--trusted-proxy-ip` flag in `v7.15.2`. If you leave it unset, OAuth2 Proxy will **continue to trust ALL** source IPs (0.0.0.0/0) for backwards compatibility, which means a client may still be able to spoof forwarded headers. Therefore after upgrading we urge you to use the new `--trusted-proxy-ip` flag to set the IPs or CIDR ranges of the reverse proxies that are allowed to send `X-Forwarded-*` headers and furthermore implement the mitigation steps outlined below to properly configure your load balancer infrastructure. ### Mitigation - Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level - Explicitly overwrite `X-Forw
GHSA-7x63-xv5r-3p2x
Primary source · Revision 2
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-7x63-xv5r-3p2x
github.com/oauth2-proxy/oauth2-proxy/v7
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 7.15.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.5.0"
},
{
"fixed": "7.15.2"
}
]
}
],
"package": {
"name": "github.com/oauth2-proxy/oauth2-proxy/v7",
"purl": "pkg:golang/github.com/oauth2-proxy/oauth2-proxy/v7",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-7x63-xv5r-3p2x/GHSA-7x63-xv5r-3p2x.json"
}
}
]- Related CVEs
- CVE-2026-40575
Source reference:
/aliasesCVE-2026-76835Source reference:
/aliases
Publisher severity
critical
Source reference: /database_specific/severity
- Event
- #60859 · Revision 2
- Added to Heist Feed
- Publisher date
GO-2026-5236
Revision 2
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-5236
github.com/oauth2-proxy/oauth2-proxy
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
github.com/oauth2-proxy/oauth2-proxy/v7
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 7.15.2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "github.com/oauth2-proxy/oauth2-proxy",
"purl": "pkg:golang/github.com/oauth2-proxy/oauth2-proxy",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-5236.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.5.0"
},
{
"fixed": "7.15.2"
}
]
}
],
"package": {
"name": "github.com/oauth2-proxy/oauth2-proxy/v7",
"purl": "pkg:golang/github.com/oauth2-proxy/oauth2-proxy/v7",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-5236.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-40575
Source reference:
/aliasesCVE-2026-76835Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #60860 · Revision 2
- Added to Heist Feed
- Publisher date