{"id":"CVE-2026-40575","aliases":["GHSA-7x63-xv5r-3p2x","BIT-oauth2-proxy-2026-40575","BIT-oauth2-proxy-2026-76835","CVE-2026-76835","GO-2026-5236"],"title":"OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing","summary":"OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","vendor":"oauth2-proxy","product":"github.com/oauth2-proxy/oauth2-proxy/v7","ecosystem":"go","affected":["github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2"],"patched":["github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2"],"published":"2026-04-15","updated":"2026-09-25","sourceUpdated":"2026-09-25T14:25:56.584542414Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7x63-xv5r-3p2x","references":[{"url":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40575"},{"url":"https://access.redhat.com/security/cve/CVE-2026-40575"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460449"},{"url":"https://github.com/oauth2-proxy/oauth2-proxy"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40575"},{"url":"https://access.redhat.com/errata/RHSA-2026:58471"}],"tags":["osv","go","csaf","vex","red-hat"],"epss":0.00477,"epssPercentile":0.41012,"cwe":["CWE-290"],"scores":{"osv":9.1,"vendor":8.7},"ingestedAt":"2026-07-21T19:04:58.367Z","slug":"CVE-2026-40575","body":"## Overview\n\n### Impact\n\nA configuration-dependent authentication bypass exists in OAuth2 Proxy.\n\nDeployments are affected when all of the following are true:\n\n* OAuth2 Proxy is configured with `--reverse-proxy`\n* and at least one rule is defined with `--skip_auth_routes` or the legacy `--skip-auth-regex`\n\nOAuth2 Proxy may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-route` or `--skip-auth-regex` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application.\n\nThis can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.\n\n\n### Patches\nThis issue is addressed as part of the newly introduced `--trusted-proxy-ip` flag in `v7.15.2`. If you leave it unset, OAuth2 Proxy will **continue to trust ALL** source IPs (0.0.0.0/0) for backwards compatibility, which means a client may still be able to spoof forwarded headers. Therefore after upgrading we urge you to use the new `--trusted-proxy-ip` flag to set the IPs or CIDR ranges of the reverse proxies that are allowed to send `X-Forwarded-*` headers and furthermore implement the mitigation steps outlined below to properly configure your load balancer infrastructure.\n\n### Mitigation\n\n- Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level\n- Explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy\n\n  Example nginx mitigation for the auth subrequest:\n  ```\n    location /internal-auth/ {\n      internal; # Ensure external users can't access this path\n  \n      # Make sure the OAuth2 Proxy knows where the original request came from.\n      proxy_set_header Host       $host;\n      proxy_set_header X-Real-IP  $remote_addr;\n      # set the value to the actual $request_uri and therefore strip any user provided X-Forwarded-Uri\n      proxy_set_header X-Forwarded-Uri $request_uri;\n  \n      proxy_pass http://oauth2-proxy:4180/;\n    }\n  ```\n- Restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy\n- Remove or narrow `--skip-auth-route` / `--skip-auth-regex` rules where possible\n\n## Affected packages\n\n- `github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2`\n\n## Vendor advisories\n\n- **RHSA-2026:58471** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:58471)\n- **Red Hat VEX** · Important · affected: Red Hat Ceph Storage 9 · no fix planned: Red Hat Ceph Storage 9 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":211300,"id":"CVE-2026-40575","ts":1790407113627,"field":"cvss","old":"8.7","new":"9.1"},{"seq":211299,"id":"CVE-2026-40575","ts":1790407113627,"field":"severity","old":"high","new":"critical"},{"seq":208490,"id":"CVE-2026-40575","ts":1790005719410,"field":"cvss","old":"9.1","new":"8.7"},{"seq":208489,"id":"CVE-2026-40575","ts":1790005719410,"field":"severity","old":"critical","new":"high"}]}