CSIRT-ITA said a public proof of concept now exists for CVE-2026-76835 in OAuth2 Proxy, affecting versions through 7.15.4. The issue can let a remote, unauthenticated attacker bypass authentication and reach protected apps.
The flaw sits in reverse-proxy setups that use skip-auth rules without an explicit trusted_proxy_ip. In that case, OAuth2 Proxy may treat a client-supplied X-Forwarded-Uri header as trustworthy when deciding whether a request should skip login, so the bypass comes from the trust check, not from breaking the proxy itself.
For teams that put OAuth2 Proxy in front of internal apps, the exposure lives at the access gate: if the proxy is missing the trusted proxy setting, the protected service can be reachable without any valid user session. A public PoC makes that configuration gap immediately actionable.