Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-76835— OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

Quick assessment

Affected
oauth2-proxy oauth2-proxy
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OAuth2 Proxy 在判断是否可跳过身份验证时，会信任客户端提供的 请求头。这是因为针对 CVE-2026-40575 所添加的安全防护机制在默认的反向代理配置下实际上无效。 具体而言，在 中， 函数在 返回 true 时，优先采用 头，而非真实的请求 URI。随后，在 中， 函数会基于该构造出的路径（来自上述 header）来匹配 和 白名单，以决定是否允许跳过认证。 函数定义于 ，当调用方的地址位于可信代理地址集合中时，它即授予对该转发头的信任。而 函数在启用反向代理模式但未显式配置 时，会回退使用默认可

CVSS 9.1 · Critical EPSS 0.35% · P27

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
oauth2-proxy oauth2-proxy 7.15.2≤ 7.15.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76835

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
Source: CVE Program / CVE List V5
Vulnerability Description
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
oauth2-proxy oauth2-proxy 7.15.2 ~ 7.15.4 -

II. Public POCs for CVE-2026-76835

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 7799 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-76835

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-76835 (2)

News Coverage for CVE-2026-76835 (1)

Vendor Pages for CVE-2026-76835 (1)

Other References for CVE-2026-76835 (1)

IV. Related Vulnerabilities

Same product: oauth2-proxy
Same vendor: oauth2-proxy
Same weakness: CWE-290

V. Comments for CVE-2026-76835

No comments yet

Leave a comment