CVE-2026-40574: OAuth2 Proxy Authorization Bypass via Malformed Multi-@ Email Claims
Summary
CVE-2026-40574: OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims. Affects github.com/oauth2-proxy/oauth2-proxy/v7 versions < 7.15.2. Fixed in 7.15.2. How to fix ↓
Also tracked for
- github.com/oauth2-proxy/oauth2-proxy · Go
- oauth2-proxy · Bitnami
The same CVE-2026-40574 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OAuth2 Proxy is an open-source reverse proxy that provides authentication for applications using OAuth2. It allows users to authenticate with various identity providers and supports features like email domain restrictions to enhance security. However, it is vulnerable to an authorization bypass issue that can be exploited in specific configurations.
Vulnerability Detail
An authorization bypass exists in OAuth2 Proxy related to the 'email_domain' enforcement option. Attackers can authenticate using malformed email claims, such as 'attacker@evil.com@company.com', which can incorrectly satisfy allowed domain checks for 'company.com'. This vulnerability primarily affects self-hosted or custom OIDC environments that do not strictly validate email syntax. Standard hosted providers that enforce valid email formatting are not affected. The risk is significant as it allows unauthorized access to resources.
How To Fix
Latest published version: v7.15.5 as of 23 Oct 2026
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.15.2
This is the first release that contains the fix.
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that the configured identity provider cannot emit malformed or attacker-controlled email claim values. This may involve adjusting settings in the identity provider to enforce strict email validation.
Conclusion
The OAuth2 Proxy vulnerability CVE-2026-40574 poses a significant risk of authorization bypass through malformed email claims. Users are advised to upgrade to version 7.15.2 or later to mitigate this issue. Implementing the suggested workarounds can provide temporary relief until the upgrade is completed.
See every vulnerability recorded for github.com/oauth2-proxy/oauth2-proxy/v7 →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a moderate level of risk.
Only deployments that rely on 'email_domain' restrictions and accept email claims from identity providers that do not enforce valid email syntax are affected.
If immediate upgrading is not possible, implement the recommended workaround to prevent the issuance of malformed email claims.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/oauth2-proxy/oauth2-proxy/v7.
