CVE-2026-40575: OAuth2 Proxy Authentication Bypass via X-Forwarded-Uri Header Spoofing
Summary
CVE-2026-40575: OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing. Affects github.com/oauth2-proxy/oauth2-proxy/v7 versions >= 7.5.0, < 7.15.2. Fixed in 7.15.2. How to fix ↓
Also tracked for
- oauth2-proxy · Bitnami
- github.com/oauth2-proxy/oauth2-proxy · Go
- oauth2-proxy · Bitnami
The same CVE-2026-40575 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OAuth2 Proxy is an open-source reverse proxy that provides authentication for applications using OAuth2. It allows users to secure their applications by managing user sessions and authentication flows. However, a configuration-dependent vulnerability exists that can lead to authentication bypass, particularly when certain flags are enabled.
Vulnerability Detail
A critical vulnerability in OAuth2 Proxy allows an unauthenticated remote attacker to bypass authentication by spoofing the X-Forwarded-Uri header. This occurs when OAuth2 Proxy is configured with the --reverse-proxy flag and has skip authentication routes defined. The attacker can manipulate the X-Forwarded-Uri header, causing OAuth2 Proxy to evaluate authentication rules against a different path than intended, potentially granting access to protected resources without a valid session.
How To Fix
Latest published version: v7.15.5 as of 23 Oct 2026
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.15.2
This is the first release that contains the fix.
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement the following measures at your reverse proxy or load balancer level:
- Strip any client-provided X-Forwarded-Uri header.
- Overwrite X-Forwarded-Uri with the actual request URI before forwarding requests to OAuth2 Proxy:
Example Nginx configuration:
location /internal-auth/ {
internal; # Ensure external users can't access this path
# Make sure the OAuth2 Proxy knows where the original request came from.
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
# Set the value to the actual $request_uri and strip any user provided X-Forwarded-Uri
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_pass http://oauth2-proxy:4180/;
}
Conclusion
CVE-2026-40575 represents a significant security risk for OAuth2 Proxy users, allowing for potential authentication bypass through header spoofing. It is crucial to update to the latest version and implement recommended configurations to safeguard applications.
See every vulnerability recorded for github.com/oauth2-proxy/oauth2-proxy/v7 →
FAQ
CVE-2026-40575 is a critical vulnerability in OAuth2 Proxy that allows attackers to bypass authentication by spoofing the X-Forwarded-Uri header.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If exploited, this vulnerability can allow unauthorized access to protected routes, potentially compromising sensitive data and application security.
Update OAuth2 Proxy to version 7.15.2 or later and configure the --trusted-proxy-ip flag. Additionally, implement the suggested workarounds at your reverse proxy or load balancer.
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/oauth2-proxy/oauth2-proxy/v7.
