OAuth2 Proxy Fixed a Header-Spoofing Bypass. Then Its Default Undid the Fix.
Photo: Forkast
An unauthenticated remote attacker can bypass authentication in OAuth2 Proxy versions 7.15.2 through 7.15.4 by manipulating the X-Forwarded-Uri header. The vulnerability, tracked as CVE-2026-76835 , carries a CVSS score of 9.1 and is classified under CWE-290: Authentication Bypass by Spoofing . The mechanism is straightforward: an attacker sends a request to a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route — /health , /metrics , /ping . OAuth2 Proxy evaluates the skip-auth condition against the spoofed header. The upstream service receives the protected path unchanged.
Source: Forkast
