CVE-2026-40575
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.
Published Apr 22, 2026 · updated Jul 15, 2026 · oauth2 proxy project oauth2 proxy
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied header when is enabled and or is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with enabled and configure at least one or rule. This issue is patched in . Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided header at the reverse proxy or load balancer level; explicitly overwrite with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow / rules where possible. For nginx-based deployments, ensure is set by nginx and not passed through from the client.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 22, 2026 · NIST NVD
Detected
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied header when is enabled and or is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticate
Jul 15, 2026 · NIST NVD
Updated
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied header when is enabled and or is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticate
Affected
- cpe oauth2 proxy project/oauth2 proxyversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40575
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40575
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied header when is enabled and or is configured. An attacker can
nvd.nist.gov