CVE-2026-40575

[CVE catalog]

Severity

Critical · CVSS 9.1

Published

Apr 21, 2026, 11:20:30 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.48% · Oct 25, 2026

A flaw was found in OAuth2 Proxy. When configured with `--reverse-proxy` and either `--skip-auth-regex` or `--skip-auth-route`, the proxy may trust a client-supplied `X-Forwarded-Uri` header. An unauthenticated remote attacker can exploit this by spoofing the header, leading to an authentication bypass. This allows unauthorized access to protected routes without a valid session. oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header There's an Important flaw in `oauth2-proxy` software where it trusts a client supplied `X-Forwarded-Uri` request header. This header is used by `oauth2-proxy` to identify the original URI from the incoming request it's currently handling. An attacker which manages to spoof the requests sent to it when it's running behind a reverse-proxy may change this header field to match the routes or the regular expressions configured to have authentication skipped, as a consequence the attacker may manage to have access to protected resources or internal routes without any kind of authentication being required resulting in a high impact for data confidentiality and integrity for the services positioned behind the reverse proxy. Red Hat Product Security team has rated this vulnerability as having a impact of Important as for a `oauth2-proxy` being considered vulnerable it should be being executed with the following specific configuration options enabled: 1) `--reverse-proxy` 2) `--skip-auth-regex` or `--skip-auth-route` Additionally to exploit this vulnerability the attacker should be able to change the headers in the request being sent (either via a local proxy or by performing a Man-In-The-Middle attack before) and should have previous knowledge about the routes or patterns of URI which the authentication are being skipped by the `oauth2-proxy` deployment. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.