OAuth2 HTTP Filter Vulnerability in Envoy Proxy by EnvoyProxy
CVE-2026-47775

6.8MEDIUM

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
26 June 2026

What is CVE-2026-47775?

Envoy, an open source edge and service proxy, has a vulnerability in its OAuth2 HTTP filter prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. The encrypt()/decrypt() functions employ AES-256-CBC without authentication tags, which allows attackers to exploit a padding oracle. When users access the /callback endpoint, the filter responds with HTTP 302 on successful decryption or HTTP 401 on padding failure. By exploiting this, an attacker can retrieve the plaintext PKCE code_verifier from an encrypted CodeVerifier cookie in approximately 6,200 requests, allowing them to exchange it for a stolen authorization code and ultimately gain access to the victim’s tokens. This vulnerability can expose sensitive user data and compromise the integrity of application security.

Affected Version(s)

envoy >= 1.38.0, < 1.38.1 < 1.38.0, 1.38.1

envoy >= 1.37.0, < 1.37.3 < 1.37.0, 1.37.3

envoy >= 1.36.0, < 1.36.7 < 1.36.0, 1.36.7

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.