CVE-2026-76835
CVSS 9.1 CRITICAL: oAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip… EPSS 0.5% (37th percentile).
Vulnerabilities & Exploits · Web App Attack
CSIRT-ITA said a public proof of concept now exists for CVE-2026-76835 in OAuth2 Proxy, affecting versions through 7.15.4. The issue can let a remote, unauthenticated attacker bypass authentication and reach protected apps.
The flaw sits in reverse-proxy setups that use skip-auth rules without an explicit trusted_proxy_ip. In that case, OAuth2 Proxy may treat a client-supplied X-Forwarded-Uri header as trustworthy when deciding whether a request should skip login, so the bypass comes from the trust check, not from breaking the proxy itself.
For teams that put OAuth2 Proxy in front of internal apps, the exposure lives at the access gate: if the proxy is missing the trusted proxy setting, the protected service can be reachable without any valid user session. A public PoC makes that configuration gap immediately actionable.
1 source · Aug 27
CVSS 9.1 CRITICAL: oAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip… EPSS 0.5% (37th percentile).
CSIRT Italia / ACN
Oauth2: PoC pubblico per lo sfruttamento di una vulnerabilità con gravità "critica"
Disponibile un Proof of Concept (PoC) per la CVE-2026-76835 presente in OAuth2 Proxy.
originalPart of the PlainSec briefing for 2026-08-27
Every edition of this story: OAuth2 Proxy PoC Exposes Login Bypass Risk