OAuth2 Proxy versions 7.5.0 through 7.15.1 are vulnerable to an authentication bypass that allows unauthenticated attackers to access protected resources by manipulating request paths.

This is an authentication bypass (CWE-288) triggered when using skip_auth_routes or skip_auth_regex configurations. An unauthenticated attacker can supply a path containing a # or its encoded form %23 to trick the proxy into matching a public allowlist rule while the backend processes the request as a protected resource.

Successful exploitation of this flaw allows unauthorized access to sensitive backend applications that rely on OAuth2 Proxy for authentication. Given the CVSS score of 8.2, this vulnerability represents a high risk to data confidentiality, as attackers can bypass security controls to access restricted endpoints without valid credentials.

Immediate Action: Upgrade OAuth2 Proxy to version 7.15.2 or later to ensure proper request path normalization before allowlist matching occurs.

Proactive Monitoring: Review access logs for requests containing the # character or the %23 encoded sequence, especially on routes configured within skip_auth_routes or skip_auth_regex.

Compensating Controls: If an immediate update is not feasible, reconfigure the proxy to use exact public path matching with tightly scoped rules, or disable skip_auth_routes and skip_auth_regex if they are not strictly required for business operations.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the security boundary of protected services. Administrators should prioritize updating to version 7.15.2 immediately. If the software is deployed in an environment where skip_auth_routes are utilized, perform a review of current configurations to ensure that no overly broad path patterns are in use, as these increase the attack surface for this specific bypass.