An authentication bypass vulnerability in oauth2-proxy allows unauthenticated attackers to access restricted upstream paths by spoofing HTTP headers.

The vulnerability exists due to improper trust configuration where the application treats all clients as trusted proxies by default. An unauthenticated attacker can supply a malicious X-Forwarded-Uri header to trick the application into bypassing authentication checks for protected routes.

Successful exploitation allows unauthorized access to sensitive upstream applications that rely on oauth2-proxy for security. Given the 9.1 CVSS score, this represents a critical risk, potentially leading to full data exposure or unauthorized actions within protected backend services.

Immediate Action: Update oauth2-proxy to version 7.15.5 or later to resolve the trust configuration flaw.

Proactive Monitoring: Review access logs for requests containing suspicious X-Forwarded-Uri headers that deviate from expected application traffic patterns.

Compensating Controls: Configure the trusted_proxy_ip setting to strictly limit which IP addresses are permitted to set proxy headers, effectively neutralizing the default permissive behavior.

Public Exploit Available: No

This vulnerability presents a high risk to infrastructure security by undermining core authentication controls. Administrators should prioritize patching the software immediately and auditing current proxy configuration files to ensure that only authorized IP ranges are permitted to influence routing logic.