{"id":"EUVD-2026-24557","enisaUuid":"608af025-4f0b-3de5-a82b-1dba60f836a4","description":"OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with `--reverse-proxy` enabled and configure at least one `--skip-auth-regex` or `--skip-auth-route` rule. This issue is patched in `v7.15.2`. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level; explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow `--skip-auth-regex` / `--skip-auth-route` rules where possible. For nginx-based deployments, ensure `X-Forwarded-Uri` is set by nginx and not passed through from the client.","datePublished":"Apr 21, 2026, 11:20:30 PM","dateUpdated":"Jul 15, 2026, 1:00:45 AM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x\n","aliases":"CVE-2026-40575\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"787fafe4-b738-3477-8ceb-35d536f4313f","product":{"name":"oauth2-proxy","vendor":{"name":"oauth2-proxy"}},"product_version":"7.5.0, \u003c 7.15.2"}],"enisaIdVendor":[{"id":"c33c20dc-a253-336f-a2b5-3b436be8ac7a","vendor":{"name":"oauth2-proxy"}}],"enisaIdVulnerability":[{"id":"730ba611-a2c1-3568-82d8-756b7ee006ba","vulnerability":{"id":"CVE-2026-40575","description":"OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with `--reverse-proxy` enabled and configure at least one `--skip-auth-regex` or `--skip-auth-route` rule. This issue is patched in `v7.15.2`. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level; explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow `--skip-auth-regex` / `--skip-auth-route` rules where possible. For nginx-based deployments, ensure `X-Forwarded-Uri` is set by nginx and not passed through from the client.","datePublished":"Apr 21, 2026, 11:20:30 PM","dateUpdated":"Jul 15, 2026, 1:00:45 AM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x\n","enisa_id":"EUVD-2026-24557\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 9, 2026, 7:15:55 AM","vulnerabilityProduct":[{"id":"fe8673fa-5e32-353c-b92b-a36518c49faf","product":{"name":"oauth2-proxy","vendor":{"name":"oauth2-proxy"}},"product_version":"7.5.0, \u003c 7.15.2"}],"vulnerabilityVendor":[{"id":"098ebdec-5f99-3cb2-a361-b9015e246b9f","vendor":{"name":"oauth2-proxy"}}]}},{"id":"bb305e65-7b9b-366f-a780-3483c8a1789a","vulnerability":{"id":"GHSA-7x63-xv5r-3p2x","description":"OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing","datePublished":"Apr 15, 2026, 7:21:06 PM","dateUpdated":"Jul 21, 2026, 1:50:15 PM","baseScore":0.0,"references":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40575\nhttps://access.redhat.com/security/cve/CVE-2026-40575\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2460449\nhttps://github.com/oauth2-proxy/oauth2-proxy\nhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json\n","enisa_id":"EUVD-2026-24557\n","aliases":"GHSA-7x63-xv5r-3p2x\nCVE-2026-40575\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:57:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"0f8a1da1-24ac-34ff-a2d6-18c289c6f8c8","advisory":{"id":"RHSA-2026:58471","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Aug 22, 2026, 12:36:49 AM","dateUpdated":"Sep 21, 2026, 5:22:32 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:58471\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58471.json\n","aliases":"CVE-2026-40575\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"a6545d2e-677f-3cd4-8439-c919e7e822e5","product":{"name":"oauth2-proxy-0:7.15.4-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"c5aab48e-1089-392a-9b10-3833e65db0f4","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"f0e85af5-e74a-3697-8df9-013e93ddc3c2","product":{"name":"oauth2-proxy-0:7.15.4-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"f7cfe16a-72db-3c2b-b2c2-37441d348d48","product":{"name":"oauth2-proxy-0:7.15.4-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}