Privilege Escalation Vulnerability in OAuth2-Proxy Affecting Multiple Applications

CVE-2025-64484

What is CVE-2025-64484?

OAuth2-Proxy, an open-source tool serving as a reverse proxy or middleware, has a vulnerability in versions prior to 7.13.0 that allows authenticated users to inject underscore variants of X-Forwarded-* headers. This can potentially bypass the proxy's filtering logic, leading to privilege escalation in upstream applications that normalize underscores to dashes. Although the authentication and authorization mechanisms of OAuth2 Proxy remain intact, the injected headers can exploit misconfigurations in hosted applications like Django, Flask, FastAPI, among others. The vulnerability has been addressed in version 7.13.0, which now normalizes specified headers, ensuring that variations in capitalization and the use of underscores versus dashes are treated equivalently. For specific use cases that require retaining certain headers, an additional configuration, InsecureSkipHeaderNormalization, has been introduced. It's recommended to fortify your upstream services’ filtering logic to handle such header variants securely.

References