CVE-2026-40575: OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
(updated )
A configuration-dependent authentication bypass exists in OAuth2 Proxy.
Deployments are affected when all of the following are true:
- OAuth2 Proxy is configured with
--reverse-proxy - and at least one rule is defined with
--skip_auth_routesor the legacy--skip-auth-regex
OAuth2 Proxy may trust a client-supplied X-Forwarded-Uri header when --reverse-proxy is enabled and --skip-auth-route or --skip-auth-regex is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application.
This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.
References
- access.redhat.com/security/cve/CVE-2026-40575
- bugzilla.redhat.com/show_bug.cgi?id=2460449
- github.com/advisories/GHSA-7x63-xv5r-3p2x
- github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x
- nvd.nist.gov/vuln/detail/CVE-2026-40575
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json
Code Behaviors & Features
Detect and mitigate CVE-2026-40575 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →