Vulnerability · Published Apr 14, 2026 · Assigned by GitHub_M
CVE-2026-34457OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
Critical 9.1
In plain English
A critical-severity authentication bypass by spoofing in oauth2-proxy from oauth2-proxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health check regardless of the requested path, allowing an unauthenticated remote attacker to bypass authentication and access protected upstream resources. Deployments that do not use auth_request-style subrequests or that do not enable --ping-user-agent/--gcp-healthchecks are not affected. This issue is fixed in 7.15.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/oauth2-proxy/oauth2-proxy | no fix listed | GHSA-5hvv-m4w4-gf6v |
| Go | github.com/oauth2-proxy/oauth2-proxy | no fix listed | GO-2026-5147 |
| Go | github.com/oauth2-proxy/oauth2-proxy/v7 | 7.15.2 | GHSA-5hvv-m4w4-gf6v |
| Go | github.com/oauth2-proxy/oauth2-proxy/v7 | 7.15.2 | GO-2026-5147 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| oauth2-proxy | oauth2-proxy | < 7.15.2 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N