Skip to content
Threat Feed

Tag

Oauth2-Proxy

1 brief RSS
critical advisory

OAuth2 Proxy Authentication Bypass via User-Agent Header

A critical authentication bypass vulnerability (CVE-2026-34457) exists in OAuth2 Proxy when used with `auth_request`-style integration and either `--ping-user-agent` is set or `--gcp-healthchecks` is enabled, allowing unauthenticated access to protected resources.

oauth2-proxy authentication-bypass web-application
2r 1t