{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aoauth2_proxy_projectoauth2_proxy/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-40575"},{"cvss":9.1,"id":"CVE-2026-76835"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OAuth2 Proxy"],"_cs_severities":["critical"],"_cs_tags":["oauth2-proxy","authentication-bypass","reverse-proxy","header-spoofing"],"_cs_type":"advisory","_cs_vendors":["OAuth2 Proxy"],"content_html":"\u003cp\u003eOAuth2 Proxy versions before 7.15.2 are susceptible to an authentication bypass vulnerability (CVE-2026-40575) when configured with both the \u003ccode\u003e--reverse-proxy\u003c/code\u003e flag and either \u003ccode\u003e--skip_auth_routes\u003c/code\u003e or \u003ccode\u003e--skip_auth_regex\u003c/code\u003e. This configuration flaw allows an attacker to spoof the \u003ccode\u003eX-Forwarded-Uri\u003c/code\u003e header, tricking OAuth2 Proxy into evaluating authentication and skip-auth rules against an attacker-controlled path rather than the actual request URI. The vulnerability exists because OAuth2 Proxy trusts client-supplied \u003ccode\u003eX-Forwarded-Uri\u003c/code\u003e headers. Version 7.15.2 introduces the \u003ccode\u003e--trusted-proxy-ip\u003c/code\u003e flag to mitigate this issue by allowing administrators to specify trusted reverse proxy IPs. However, upgrading alone is insufficient; the \u003ccode\u003e--trusted-proxy-ip\u003c/code\u003e flag must be configured, and additional mitigation steps are recommended to properly secure deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an OAuth2 Proxy instance configured with \u003ccode\u003e--reverse-proxy\u003c/code\u003e and \u003ccode\u003e--skip_auth_routes\u003c/code\u003e (or \u003ccode\u003e--skip_auth_regex\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting a protected route.\u003c/li\u003e\n\u003cli\u003eThe attacker adds an \u003ccode\u003eX-Forwarded-Uri\u003c/code\u003e header to the request, setting its value to a path configured in \u003ccode\u003e--skip_auth_routes\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe reverse proxy forwards the request, including the attacker-controlled \u003ccode\u003eX-Forwarded-Uri\u003c/code\u003e header, to the OAuth2 Proxy instance.\u003c/li\u003e\n\u003cli\u003eOAuth2 Proxy evaluates the \u003ccode\u003eX-Forwarded-Uri\u003c/code\u003e header against the \u003ccode\u003e--skip_auth_routes\u003c/code\u003e rules and incorrectly determines that authentication is not required.\u003c/li\u003e\n\u003cli\u003eOAuth2 Proxy forwards the request, now bypassing authentication, to the upstream application.\u003c/li\u003e\n\u003cli\u003eThe upstream application processes the request, granting the attacker unauthorized access to the protected resource.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully accesses the protected route and performs unauthorized actions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability (CVE-2026-40575) allows unauthenticated remote attackers to bypass authentication and access protected routes without valid credentials. This could lead to complete compromise of the application behind the OAuth2 Proxy instance, including data theft, modification, or service disruption. The severity is critical as it directly undermines the authentication mechanism, potentially affecting any organization using OAuth2 Proxy with the vulnerable configuration. The number of affected organizations is currently unknown, but any deployment meeting the criteria is vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OAuth2 Proxy to version 7.15.2 or later and configure the \u003ccode\u003e--trusted-proxy-ip\u003c/code\u003e flag to explicitly define trusted reverse proxy IPs to mitigate CVE-2026-40575.\u003c/li\u003e\n\u003cli\u003eImplement reverse proxy or load balancer rules to strip or overwrite the \u003ccode\u003eX-Forwarded-Uri\u003c/code\u003e header from client requests, ensuring OAuth2 Proxy receives the correct request URI, as shown in the nginx example.\u003c/li\u003e\n\u003cli\u003eRestrict direct client access to OAuth2 Proxy, ensuring it can only be reached through a trusted reverse proxy to prevent attackers from directly injecting malicious headers.\u003c/li\u003e\n\u003cli\u003eReview and narrow \u003ccode\u003e--skip-auth-route\u003c/code\u003e / \u003ccode\u003e--skip-auth-regex\u003c/code\u003e rules where possible to minimize the attack surface and reduce the potential for authentication bypass.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T20:03:09Z","date_published":"2024-01-29T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-29-oauth2-proxy-auth-bypass/","summary":"OAuth2 Proxy is vulnerable to an authentication bypass when configured with `--reverse-proxy` and `--skip_auth_routes` or `--skip_auth_regex`; by spoofing the `X-Forwarded-Uri` header, an attacker can bypass authentication and access protected routes without a valid session.","title":"OAuth2 Proxy Authentication Bypass via X-Forwarded-Uri Header Spoofing","url":"https://feed.craftedsignal.io/briefs/2024-01-29-oauth2-proxy-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}