Skip to content
Fencer Vulns
critical 9.1

CVE-2026-40575 json

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

published 2026-04-15 6 mo ago modified 2026-10-01 38 d ago also BIT-oauth2-proxy-2026-40575 , BIT-oauth2-proxy-2026-76835 , CVE-2026-76835 , EUVD-2026-24557 , GHSA-7x63-xv5r-3p2x , GO-2026-5236

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application. This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session. Impacted users are deployments that run oauth2-proxy with `--reverse-proxy` enabled and configure at least one `--skip-auth-regex` or `--skip-auth-route` rule. This issue is patched in `v7.15.2`. Some workarounds are available for those who cannot upgrade immediately. Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level; explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy; restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; and/or remove or narrow `--skip-auth-regex` / `--skip-auth-route` rules where possible. For nginx-based deployments, ensure `X-Forwarded-Uri` is set by nginx and not passed through from the client.

Patch / fix

  • go github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2
  • bitnami oauth2-proxy 7.15.2, 7.15.5
  • oauth2_proxy_project oauth2_proxy 7.15.2
  • oauth2-proxy hummingbird 1 7.15.4-0.1.hum1

red hat advisories RHSA-2026:58471

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40575 updated cvss 8.7

oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header

  • Red Hat Ceph Storage 9 rhceph/oauth2-proxy-rhel9
    affected: workaround, no fix available
  • Red Hat Hardened Images oauth2-proxy 7.15.4-0.1.hum1
    fixed: vendor fix RHSA-2026:58471

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
6 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/oauth2-proxy/oauth2-proxy/v7
>=7.5.0, <7.15.2
7.15.2
bitnami oauth2-proxy
>=7.5.0, <7.15.2
>=7.15.2, <7.15.5
7.15.2
7.15.5
go github.com/oauth2-proxy/oauth2-proxy
all versions
 no fix listed

Affected products

  • oauth2-proxy oauth2-proxy
  • Red Hat Red Hat Ceph Storage 9

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.