An authentication bypass vulnerability in OAuth2-Proxy allows attackers to spoof requests and gain unauthorized access to protected resources.

This is an authentication bypass by spoofing (CWE-290) occurring in the proxy request handling logic. The vulnerability can be exploited by an unauthenticated attacker to bypass security controls.

Exploitation of this flaw allows attackers to bypass authentication mechanisms, potentially gaining access to protected downstream applications or services. With a CVSS score of 9.1, this represents a critical risk to the security posture of any environment relying on OAuth2-Proxy for identity enforcement.

Immediate Action: Upgrade to OAuth2-Proxy version 7.11.0 or later to apply the necessary security fixes.

Proactive Monitoring: Review proxy logs for anomalous request headers or unexpected traffic patterns that bypass expected authentication flows.

Compensating Controls: If upgrading is not immediately possible, implement additional header validation at the load balancer or ingress controller level to reject suspicious or malformed requests.

Public Exploit Available: No (unknown)

Given the critical nature of an authentication bypass, it is imperative that all instances of OAuth2-Proxy are updated to version 7.11.0 immediately. Failure to patch may result in unauthorized access to sensitive application backends.