oauth2-proxy v7.15.2 security fixes

{
  "id": "824ef66c4a9181e9eb7bac80bf46dfc014497af466857e8d3b82457e2154e83f",
  "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.2",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "oauth2-proxy v7.15.2 security fixes",
    "summary": "oauth2-proxy v7.15.2 fixes multiple security vulnerabilities, including authentication bypasses, route-fragment evaluation, and malformed email-claim validation. It also introduces a flag for specifying trusted reverse proxy IPs.",
    "evidence": "Release notes from oauth2-proxy\nv7.15.2\n\nRelease Highlights 🔵 Golang version upgrade to v1.25.9 Upgrade of all dependencies to their latest versions",
    "products": [
      {
        "name": {
          "value": "OAuth2 Proxy",
          "evidence": "We have had security audits performed on OAuth2 Proxy in the past couple of weeks"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v7.15.2",
            "evidence": "v7.15.2"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-34986",
        "evidence": "CVE-2026-34986"
      },
      {
        "value": "CVE-2026-32281",
        "evidence": "CVE-2026-32281"
      },
      {
        "value": "CVE-2026-32289",
        "evidence": "CVE-2026-32289"
      },
      {
        "value": "CVE-2026-32288",
        "evidence": "CVE-2026-32288"
      },
      {
        "value": "CVE-2026-32280",
        "evidence": "CVE-2026-32280"
      },
      {
        "value": "CVE-2026-32282",
        "evidence": "CVE-2026-32282"
      },
      {
        "value": "CVE-2026-32283",
        "evidence": "CVE-2026-32283"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-oauth2-proxy-oauth2-proxy",
  "document_id": 21962,
  "published_at": "2026-04-14T11:24:35+00:00"
}