CVE-2026-40575 – OAuth2 Proxy
“A spoofed forwarded URI can turn an authentication exception into direct access to protected routes.”
OAuth2 Proxy is affected by two Critical authentication bypass vulnerabilities involving X-Forwarded-Uri handling in reverse-proxy deployments. CVE-2026-40575 allows an unauthenticated attacker to spoof the forwarded request path so skip-auth rules are evaluated against an attacker-controlled URI rather than the protected upstream route. The CVSS score is 9.1, which is Critical severity.
CVE-2026-76835 shows that the original protection can remain ineffective when reverse-proxy mode uses the default trusted-proxy configuration, allowing all clients to be treated as trusted proxies and bypass authentication with a crafted header. The CVSS score is 9.1, which is Critical severity. Public proof-of-concept material is available for CVE-2026-76835. OAuth2 Proxy 7.15.2 contains the fix for CVE-2026-40575.
Key Details
- Affected Product
- Oauth2 Proxy Project Oauth2 Proxy
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-290