Authorization Bypass in OAuth2 Proxy Affects Email Domain Enforcement
CVE-2026-40574

6.8MEDIUM

Key Information:

Vendor

Oauth2-proxy

Status
Oauth2-proxy
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40574?

OAuth2 Proxy, a reverse proxy that authenticates using OAuth2 providers, contains a vulnerability that allows authorization bypass through improperly validated email claims. An attacker can exploit the email_domain enforcement option, allowing them to authenticate with malformed email addresses that meet domain requirements, such as 'attacker@evil.com@company.com'. This flaw poses a risk particularly to deployments depending on email domain restrictions that accept claims lacking strict email syntax validation. The vulnerability was addressed in version 7.15.2.

Affected Version(s)

oauth2-proxy < 7.15.2

References

https://github.com/oauth2-proxy/oauth2-proxy/security/adv...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.