CVE-2026-49332

Name of the Vulnerable Software and Affected Versions openshift/oauth-proxy (affected versions not specified)

Description A flaw exists where the proxy sets authenticated identity headers using dash-variant keys, such as 'X-Forwarded-User', but fails to strip underscore-variant keys, such as 'X Forwarded User', from incoming requests. Because WSGI and PHP frameworks normalize both variants to the same variable, an authenticated low-privilege user can smuggle a forged identity. This may allow the forged identity to override the legitimate authenticated identity within the upstream application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.