CVE-2026-76835

Name of the Vulnerable Software and Affected Versions OAuth2 Proxy versions 7.5.0 through 7.15.1

Description An authentication bypass exists when the software is configured with --reverse-proxy and has at least one rule defined via --skip auth routes or --skip-auth-regex. The system may trust a client-supplied X-Forwarded-Uri header, allowing an unauthenticated remote attacker to spoof this header. Consequently, the software evaluates authentication and skip-auth rules against the spoofed path while the actual protected path is sent to the upstream application, granting unauthorized access to protected routes.

Technical details include the GetRequestURI function in pkg/requests/util/util.go preferring the X-Forwarded-Uri header over the real request URI when CanTrustForwardedHeaders returns true. The isAllowedPath function in oauthproxy.go then matches the skip auth routes and skip auth regex allow lists against this spoofed path. This occurs because CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants trust if the caller's address is in the trusted proxy set, which defaults to 0.0.0.0/0 and ::/0 when reverse proxy mode is enabled without a configured trusted proxy ip.

Recommendations Update to version 7.15.2 and configure the --trusted-proxy-ip flag to specify the IPs or CIDR ranges of trusted reverse proxies allowed to send X-Forwarded-* headers. Strip any client-provided X-Forwarded-Uri header at the reverse proxy or load balancer level. Explicitly overwrite the X-Forwarded-Uri header with the actual request URI before forwarding requests to the software. Restrict direct client access so the software can only be reached through a trusted reverse proxy. Remove or narrow the --skip-auth-route and --skip-auth-regex rules where possible.