CVE-2026-76835
CVSS 9.1 CRITICAL: oAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip… EPSS 0.5% (37th percentile).
Vulnerabilities · 46 days ago
CSIRT-ITA said a public proof of concept now exists for CVE-2026-76835 in OAuth2 Proxy, affecting versions through 7.15.4. The issue can let a remote, unauthenticated attacker bypass authentication and reach protected apps.
The flaw sits in reverse-proxy setups that use skip-auth rules without an explicit trusted_proxy_ip. In that case, OAuth2 Proxy may treat a client-supplied X-Forwarded-Uri header as trustworthy when deciding whether a request should skip login, so the bypass comes from the trust check, not from breaking the proxy itself.
For teams that put OAuth2 Proxy in front of internal apps, the exposure lives at the access gate: if the proxy is missing the trusted proxy setting, the protected service can be reachable without any valid user session. A public PoC makes that configuration gap immediately actionable.
CVSS 9.1 CRITICAL: oAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip… EPSS 0.5% (37th percentile).
1 source covering this story
Oauth2: PoC pubblico per lo sfruttamento di una vulnerabilità con gravità "critica"
Disponibile un Proof of Concept (PoC) per la CVE-2026-76835 presente in OAuth2 Proxy.
Part of the PlainSec briefing for 2026-08-28