OOAuth2 Proxy

Products

Exploited and recent CVEs

• CVE-2026-76835 Critical 9.1 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set 0.5%
• CVE-2026-40575 Critical 9.1 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing 0.5%
• CVE-2026-41059 High 8.2 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex 0.3%
• CVE-2026-40574 Medium 6.8 OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims 0.2%
• CVE-2026-34457 Critical 9.1 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode 0.5%
• CVE-2026-34454 Low 3.5 OAuth2 Proxy: Session cookie not cleared when rendering sign-in page 0.2%
• CVE-2025-64484 High 8.5 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation 0.7%
• CVE-2025-54576 Critical 9.1 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion 1.2%
• CVE-2021-21411 Medium 5.5 Incorrect authorization in OAuth2-Proxy 1.1%
• CVE-2021-21291 Medium 4.7 Subdomain checking of whitelisted domains could allow unintended redirects 1.6%
• CVE-2020-4037 Medium 4.3 Open Redirect in OAuth2 Proxy 0.9%
• CVE-2020-11053 High 7.1 Open Redirect in OAuth2 Proxy 0.8%