CVE-2026-40575: OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied…

PriorityP264critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

0.48%

37.6th percentile

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with `--reverse-proxy` enabled and configure at least one `--skip-auth-regex` or `--skip-auth-route` rule. This issue is patched in `v7.15.2`. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level; explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow `--skip-auth-regex` / `--skip-auth-route` rules where possible. For nginx-based deployments, ensure `X-Forwarded-Uri` is set by nginx and not passed through from the client.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
github.com	oauth2-proxy_oauth2-proxy_v7	>= 7.5.0 < 7.15.2	7.15.2
oauth2-proxy	oauth2-proxy	—	—
oauth2_proxy_project	oauth2_proxy	>= 7.5.0 < 7.15.2	7.15.2
rhceph	oauth2-proxy-rhel9	—	—

Detection & IOCsextracted from sources · hover to see the quote

otherX-Forwarded-Uri↗

→Detect requests to oauth2-proxy where the client-supplied X-Forwarded-Uri header value differs from the actual request URI — this discrepancy is the core exploit primitive. ↗
→Alert on unauthenticated requests reaching protected upstream routes when oauth2-proxy is configured with --reverse-proxy AND (--skip-auth-regex OR --skip-auth-route), as these are the required preconditions for exploitation. ↗
→Monitor oauth2-proxy access logs for requests where the X-Forwarded-Uri header matches a skip-auth pattern but the actual upstream-forwarded path does not — indicating header spoofing to bypass authentication. ↗
→For nginx-based deployments, verify that X-Forwarded-Uri is explicitly set by nginx (proxy_set_header X-Forwarded-Uri $request_uri) and not passed through from the client; absence of this control indicates a vulnerable configuration. ↗

·Vulnerability is only exploitable when oauth2-proxy is run with BOTH --reverse-proxy enabled AND at least one --skip-auth-regex or --skip-auth-route rule configured; deployments without these flags are not affected. ↗
·Exploitation additionally requires the attacker to have the ability to manipulate request headers (e.g., via a local proxy or MitM) and prior knowledge of the skip-auth route patterns. ↗
·Red Hat Ceph Storage 9 package rhceph/oauth2-proxy-rhel9 is confirmed affected. ↗

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vendor_redhat9.1CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.