CVE-2025-64484: OAuth2-Proxy Header Smuggling Vulnerability Leading to Privilege Escalation
Summary
CVE-2025-64484: OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation. Affects oauth2-proxy versions < 7.13.0. Fixed in 7.13.0. How to fix ↓
Also tracked for
The same CVE-2025-64484 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OAuth2-Proxy is an open-source tool designed to act as a reverse proxy or middleware for applications, facilitating OAuth2 authentication. It is widely used in various setups, including those utilizing WSGI-based frameworks like Django, Flask, and FastAPI. The tool's primary function is to manage authentication and authorization for applications, but it has been found vulnerable to a specific issue that can lead to security risks.
Vulnerability Detail
The vulnerability arises from OAuth2-Proxy's handling of HTTP headers, specifically the normalization of underscores to dashes. In versions prior to 7.13.0, authenticated users could exploit this by injecting underscore variants of X-Forwarded-* headers, bypassing the proxy's filtering logic. This could potentially allow attackers to escalate privileges in the upstream application, although the authentication and authorization mechanisms of OAuth2 Proxy itself remain intact. The issue is particularly concerning for applications that do not properly handle such header variations.
How To Fix
Minimum fixed version
7.13.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the filtering and processing logic in upstream services does not treat underscores and hyphens in headers equivalently. This can be done by implementing strict header validation in the application code to differentiate between these characters.
Conclusion
CVE-2025-64484 highlights a significant vulnerability in OAuth2-Proxy that can lead to privilege escalation through header smuggling. Users are strongly advised to update to version 7.13.0 or later to mitigate this risk. For those unable to update immediately, implementing strict header validation can serve as a temporary measure.
See every vulnerability recorded for oauth2-proxy →
FAQ
The impact includes potential privilege escalation in applications that rely on OAuth2-Proxy for authentication, allowing attackers to bypass security measures.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions prior to 7.13.0 are affected by this vulnerability.
Yes, updating to version 7.13.0 or later addresses this vulnerability and secures your installation against the described issue.
If immediate updating is not possible, implement strict header validation in your upstream services as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for oauth2-proxy.
