CVE Intelligence
Analysis AI-assisted

CVE-2026-76835: OAuth2 Proxy authentication bypass via spoofed X-Forwarded-Uri

OAuth2 Proxy versions 7.15.2 through 7.15.4 can be induced to skip authentication for protected paths when the default trusted proxy set applies. According to the record, the flaw comes from trusting a client-supplied X-Forwarded-Uri header, so the allow-list check runs against a spoofed path. The record lists no fixed version and no exploitation confirmed by CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

OAuth2 Proxy is affected by an authentication bypass classified as CWE-290 (Authentication Bypass by Spoofing). According to the record, the skip-authentication decision can be made against a client-supplied X-Forwarded-Uri value when the default trusted proxy configuration applies. The record names VulnCheck as the CNA and links the vendor advisory GHSA-7x63-xv5r-3p2x.

Impact

  • According to the description, an unauthenticated remote client may reach upstream paths that should require authentication.
  • The record rates the issue critical: CVSS 3.1 base score 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and a CVSS 4.0 score of 9.3 from VulnCheck.
  • The CVSS 3.1 vector indicates high confidentiality and integrity impact and no availability impact.

Affected products and versions

  • Product: Oauth2-proxy Oauth2-proxy (OAuth2 Proxy).
  • Range: versions 7.15.2 through 7.15.4 inclusive, as stated in the record.
  • The record lists no fixed version. Check the vendor advisory for remediation details.
  • Per the description, the condition applies when reverse proxy mode is enabled without trusted_proxy_ip configured.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog, so KEV does not confirm active exploitation.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The record carries an SSVC exploitation value of poc and automatable value of yes. EPSS is 0.00453 with percentile 0.37587 dated 2026-10-13. These are estimates and do not indicate observed attacks.

Remediation and mitigation

  • Check the vendor advisory and the project repository for a release that fixes the issue. The record does not identify a patched version.
  • Until a fix is confirmed, review whether reverse proxy mode is enabled and whether trusted_proxy_ip is explicitly set to the address of your real reverse proxy. This follows from the default fallback described in the record.
  • Limit network access to the OAuth2 Proxy listener so that only your trusted reverse proxy can reach it.
  • Review the skip_auth_routes and skip_auth_regex entries and keep them as narrow as possible, since they drive the affected decision.
  • Do not use forwarded headers from untrusted sources as input to access decisions.

Detection guidance

  • Review reverse proxy and application logs for X-Forwarded-Uri headers arriving from sources other than your known proxies.
  • Look for requests to protected upstream paths that were served without an authenticated session, especially where the forwarded URI differs from the actual request path.
  • Compare the path evaluated by the authentication layer with the path received by the upstream service to spot mismatches.

Limitations of the available information

  • The record contains no fixed version and an empty fixes list. The absence of a fix in the record does not mean no fix exists.
  • The record source_status is Deferred.
  • The record does not describe deployments beyond the default trusted proxy configuration, nor any observed attacks.
  • Technical reproduction details are intentionally omitted.

Frequently asked questions

Which OAuth2 Proxy versions are affected by CVE-2026-76835?

According to the record, versions 7.15.2 through 7.15.4 inclusive are affected. The record does not list a fixed version, so check the vendor advisory for remediation details.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record does carry an SSVC value of poc, which is an estimate and not evidence of attacks.

What configuration makes the issue relevant?

According to the description, the condition applies when reverse proxy mode is enabled without trusted_proxy_ip configured, because the default trusted set then covers all addresses.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.