OAuth2 Proxy Fixed a Header-Spoofing Bypass. Then Its Default Undid the Fix.

An unauthenticated remote attacker can bypass authentication in OAuth2 Proxy versions 7.15.2 through 7.15.4 by manipulating the X-Forwarded-Uri header. The vulnerability, tracked as CVE-2026-76835 , carries a CVSS score of 9.1 and is classified under CWE-290: Authentication Bypass by Spoofing . The mechanism is straightforward: an attacker sends a request to a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route — /health , /metrics , /ping . OAuth2 Proxy evaluates the skip-auth condition against the spoofed header. The upstream service receives the protected path unchanged. This bypass is a direct successor to CVE-2026-40575, which affected versions 7.5.0 through 7.15.1 and exploited the same X-Forwarded-Uri trust relationship.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.