CVE-2026-49332High· 8.5▾ TwilightA flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP f…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116137Low· 3.7adm-zip: adm-zip: File integrity check bypass via duplicate archive entries (CVE-2026-116137)
CVE-2026-27896High· 7.2modelcontextprotocol/go-sdk: improper handling of case sensitivity (CVE-2026-27896)
CVE-2026-84394High· 7.5fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies (CVE-2026-84394)
CVE-2026-18427High· 7.5@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass
CVE-2026-18446High· 7.5fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority (CVE-2026-18446)
CVE-2026-16221High· 7.5fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency (CVE-2026-16221)