External risk intelligence

OAuth2 Proxy Authentication Bypass Via X-Forwarded-Uri

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-76835

OAuth2 Proxy is designed as an internet-facing gateway that sits in front of applications to handle authentication. It is explicitly meant to intercept and filter traffic, making its presence at the network edge its standard, intended, and most common deployment pattern.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in OAuth2 Proxy, a tool used to manage authentication for web applications. The issue allows unauthenticated attackers to bypass authentication by manipulating a specific header, potentially granting unauthorized access to protected resources. The main concern is confirming relevance and exposure within our environment.

Bypass authentication by faking a trusted request.
It affects a common authentication gateway.
Confirm if this gateway is used internally.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by sending a specially crafted request to OAuth2 Proxy. The proxy incorrectly trusts a `X-Forwarded-Uri` header, allowing the attacker to specify a path that matches an allow-listed route. This causes the proxy to skip authentication for a protected upstream path, granting unauthorized access.

No authentication or network access required.
Spoofed `X-Forwarded-Uri` header to match allow-list.
Bypasses authentication to protected resources.

Live Threat

Current exploitation, exposure, and threat context

When OAuth2 Proxy is configured with its default reverse proxy settings, it may incorrectly trust any client's `X-Forwarded-Uri` header. This allows an unauthenticated user to bypass authentication by providing a spoofed URI that matches an allow-listed route, while still accessing a protected upstream resource.

Protected upstream paths.
Clients send spoofed URI headers.
Unauthenticated access to protected resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this authentication bypass vulnerability in OAuth2 Proxy. The initial step involves identifying all instances of the affected technology, verifying their reachability from external networks, and determining their business criticality. Once identified, the accountable owner should be engaged to plan remediation, prioritizing systems based on their risk exposure.

Application or Platform Ownership
Verify external reachability and business criticality.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OAuth2 Proxy?

OAuth2 Proxy is an open-source software component that functions as a security gateway. It sits in front of web applications to handle identity and access management, ensuring that users are authenticated before they can access protected internal services. It acts as an intermediary, intercepting incoming web requests and validating them against identity providers.

What is the vulnerability in CVE-2026-76835?

This is an Authentication Bypass vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing). It occurs because the proxy incorrectly trusts headers supplied by any client when determining if a request should skip authentication. By sending a specific, spoofed header, an unauthorized user can trick the system into believing their request belongs to a path that is allowed to bypass security checks.

How can an attacker trigger this bypass?

An attacker triggers this by sending a request to the proxy while setting the 'X-Forwarded-Uri' header to a value that matches one of your configured allow-listed paths. This bug is active because the default configuration incorrectly treats every client as a trusted proxy. Simply accessing an unprotected, public-facing route will not trigger this; the attacker must explicitly craft this header to target a protected resource.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that OAuth2 Proxy is very likely to be at risk because it is standard practice to deploy this software at the network edge as an internet-facing gateway. Because it is designed to filter traffic, any instance exposed to the internet is a primary concern. If your proxy sits directly in front of applications without restricted access, it is effectively reachable by external actors.

Do I need to change my proxy settings?

The immediate priority is to identify all instances of OAuth2 Proxy within your environment and check their network reachability. Once located, verify if your 'trusted_proxy_ip' setting is properly configured rather than relying on the default, which currently assumes every client is trusted. Engage the owners of these services to assess which are externally accessible and require prioritized updates or configuration hardening.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.