---
id: CVE-2026-40575
aliases:
  - GHSA-7x63-xv5r-3p2x
  - BIT-oauth2-proxy-2026-40575
  - BIT-oauth2-proxy-2026-76835
  - CVE-2026-76835
  - GO-2026-5236
title: OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
summary: OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
vendor: oauth2-proxy
product: github.com/oauth2-proxy/oauth2-proxy/v7
ecosystem: go
affected:
  - 'github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2'
patched:
  - github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2
published: '2026-04-15'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T14:25:56.584542414Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7x63-xv5r-3p2x'
references:
  - url: >-
      https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40575'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-40575'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2460449'
  - url: 'https://github.com/oauth2-proxy/oauth2-proxy'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-40575'
  - url: 'https://access.redhat.com/errata/RHSA-2026:58471'
tags:
  - osv
  - go
  - csaf
  - vex
  - red-hat
epss: 0.00477
epssPercentile: 0.41012
cwe:
  - CWE-290
scores:
  osv: 9.1
  vendor: 8.7
ingestedAt: '2026-07-21T19:04:58.367Z'
---

## Overview

### Impact

A configuration-dependent authentication bypass exists in OAuth2 Proxy.

Deployments are affected when all of the following are true:

* OAuth2 Proxy is configured with `--reverse-proxy`
* and at least one rule is defined with `--skip_auth_routes` or the legacy `--skip-auth-regex`

OAuth2 Proxy may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-route` or `--skip-auth-regex` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application.

This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.


### Patches
This issue is addressed as part of the newly introduced `--trusted-proxy-ip` flag in `v7.15.2`. If you leave it unset, OAuth2 Proxy will **continue to trust ALL** source IPs (0.0.0.0/0) for backwards compatibility, which means a client may still be able to spoof forwarded headers. Therefore after upgrading we urge you to use the new `--trusted-proxy-ip` flag to set the IPs or CIDR ranges of the reverse proxies that are allowed to send `X-Forwarded-*` headers and furthermore implement the mitigation steps outlined below to properly configure your load balancer infrastructure.

### Mitigation

- Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level
- Explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy

  Example nginx mitigation for the auth subrequest:
  ```
    location /internal-auth/ {
      internal; # Ensure external users can't access this path
  
      # Make sure the OAuth2 Proxy knows where the original request came from.
      proxy_set_header Host       $host;
      proxy_set_header X-Real-IP  $remote_addr;
      # set the value to the actual $request_uri and therefore strip any user provided X-Forwarded-Uri
      proxy_set_header X-Forwarded-Uri $request_uri;
  
      proxy_pass http://oauth2-proxy:4180/;
    }
  ```
- Restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy
- Remove or narrow `--skip-auth-route` / `--skip-auth-regex` rules where possible

## Affected packages

- `github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2`

## Remediation

Upgrade to a patched release:

- `github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2`

## Vendor advisories

- **RHSA-2026:58471** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:58471)
- **Red Hat VEX** · Important · affected: Red Hat Ceph Storage 9 · no fix planned: Red Hat Ceph Storage 9 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json)