Authentication Bypass in OAuth2 Proxy by Reverse Proxy Configuration

CVE-2026-76835

What is CVE-2026-76835?

The OAuth2 Proxy application allows unauthenticated attackers to bypass authentication under certain configurations. This vulnerability arises from how the X-Forwarded-Uri header is processed when the application is set up with reverse proxy mode enabled but without proper trusted proxy configurations. If the incoming request's address is considered trusted, the application can erroneously trust the client-supplied URI, allowing attackers to access protected resources by crafting requests that match allow-listed routes. Consequently, sensitive data and services become accessible without proper authentication.

References