CVE-2026-76835: OAuth2 Proxy Auth Bypass Vulnerability

CVE-2026-76835 Overview

OAuth2 Proxy contains an authentication bypass flaw that allows unauthenticated attackers to reach protected upstream paths. The proxy trusts a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication. In the default reverse-proxy configuration, the trusted proxy set falls back to 0.0.0.0/0 and ::/0, so every client is treated as a trusted proxy. Attackers can spoof the header value to match an allow-listed route while the upstream receives the original protected path. The issue is tracked under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated network attackers can bypass authentication and reach protected upstream applications by injecting a spoofed X-Forwarded-Uri header matching any skip_auth_routes or skip_auth_regex entry.

Affected Products

OAuth2 Proxy in reverse-proxy mode without trusted_proxy_ip configured
OAuth2 Proxy versions incorporating the CVE-2026-40575 guard through v7.15.4
Deployments relying on skip_auth_routes or skip_auth_regex for allow-listing

Discovery Timeline

2026-08-24 - CVE CVE-2026-76835 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76835

Vulnerability Analysis

The flaw sits at the intersection of three OAuth2 Proxy components. GetRequestURI in pkg/requests/util/util.go prefers the X-Forwarded-Uri header over the real request URI whenever CanTrustForwardedHeaders returns true. The isAllowedPath function in oauthproxy.go then matches the skip_auth_routes and skip_auth_regex allow list against the header-supplied path rather than the actual target. The guard added for CVE-2026-40575 was intended to prevent this class of bypass but is inert in default reverse-proxy deployments.

Root Cause

CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants trust when the caller's address is in the trusted proxy set. buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip set. This default treats every remote client as an authorized upstream proxy. The bypass therefore requires no misconfiguration beyond deploying OAuth2 Proxy behind a reverse proxy with defaults.

Attack Vector

An unauthenticated attacker sends an HTTP request targeting a protected upstream path. The attacker adds an X-Forwarded-Uri header whose value matches an allow-listed route such as /health or /public. OAuth2 Proxy consults the spoofed header when running the skip-auth decision and permits the request. The upstream application then receives the original protected path unchanged and processes it without authentication context. See the GitHub Security Advisory GHSA-7x63-xv5r-3p2x and the VulnCheck advisory for detailed reproduction steps.

Detection Methods for CVE-2026-76835

Indicators of Compromise

Requests to protected upstream paths containing an X-Forwarded-Uri header set to an allow-listed route such as /health, /metrics, or /ping.
Access log entries where the request path and X-Forwarded-Uri header value differ significantly.
Upstream application requests without a session cookie or Authorization header despite hitting authenticated routes.

Detection Strategies

Inspect OAuth2 Proxy access logs for mismatches between the recorded request URI and the header-supplied URI.
Correlate unauthenticated upstream hits with the presence of X-Forwarded-Uri in the same transaction.
Deploy a WAF or reverse-proxy rule that strips or normalizes X-Forwarded-Uri from untrusted client traffic and alert when the header appears.

Monitoring Recommendations

Alert on spikes in requests carrying X-Forwarded-Uri from source addresses outside your ingress tier.
Baseline the ratio of authenticated to unauthenticated hits on skip-auth routes and flag deviations.
Track upstream 2xx responses for protected endpoints that lack a validated OAuth2 Proxy session identifier.

How to Mitigate CVE-2026-76835

Immediate Actions Required

Set trusted_proxy_ip explicitly to the CIDR ranges of your legitimate front-end proxies to disable the 0.0.0.0/0 fallback.
Configure the ingress or load balancer to strip inbound X-Forwarded-Uri headers from external clients.
Audit skip_auth_routes and skip_auth_regex entries and remove overly broad patterns.

Patch Information

Monitor the OAuth2 Proxy repository and GitHub Issue #3506 for fixed releases. Upgrade to the patched version once released and confirm that GetRequestURI no longer honors X-Forwarded-Uri when the trusted proxy set uses default values.

Workarounds

Explicitly configure trusted_proxy_ip with the addresses of your reverse proxy tier before exposing OAuth2 Proxy.
Enforce header sanitization at the perimeter so that X-Forwarded-Uri cannot originate from untrusted clients.
Temporarily disable skip_auth_routes and skip_auth_regex until upgraded and reintroduce them with strict, non-overlapping patterns.

bash

# Configuration example: restrict trusted proxies and strip client header
--reverse-proxy=true
--trusted-proxy-ip=10.0.0.0/8
--trusted-proxy-ip=192.168.0.0/16
# At ingress (nginx example):
# proxy_set_header X-Forwarded-Uri "";