CVE-2025-64484

🗓️ 10 Nov 2025 21:33:58Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 47 Views🌐 WEB

CVE-2025-64484: OAuth2-Proxy allows header smuggling via underscore X-Forwarded headers before 7.13.0.

Reporter	Title	Published	Views	Family All 22
Circl	CVE-2025-64484	10 Nov 202523:25	–	circl
CNNVD	OAuth2-Proxy security vulnerability	10 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation	10 Nov 202521:33	–	cvelist
EUVD	EUVD-2025-50825	12 Nov 202521:42	–	euvd
Github Security Blog	OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation	12 Nov 202521:42	–	github
Mend	CVE-2025-64484	10 Nov 202521:33	–	mend
NVD	CVE-2025-64484	10 Nov 202522:15	–	nvd
osv_bit	BIT-OAUTH2-PROXY-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation	12 Nov 202511:43	–	osv_bit
osv_cve	CVE-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation	10 Nov 202521:33	–	osv_cve
osv_ghsa	GHSA-VJRC-MH2V-45X6 OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation	12 Nov 202521:42	–	osv_ghsa

Vulners

Node

pusher oauth2_proxyRange<7.13.0

[
  {
    "vendor": "oauth2-proxy",
    "product": "oauth2-proxy",
    "versions": [
      {
        "version": "< 7.13.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html
uptimia	www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx
github	www.github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6
datatracker	www.datatracker.ietf.org/doc/html/rfc2616
datatracker	www.datatracker.ietf.org/doc/html/rfc822

Parameter	Position	Path	Description	CWE
X_Forwarded-For	header	/	In versions prior to 7.13.0, OAuth2 Proxy fails to normalize underscores to dashes in X-Forwarded-* headers. Attackers can inject underscore variants to bypass proxy filtering and escalate privileges in upstream applications that normalize these headers.	CWE-644
X_Forwarded_For	header	/	In versions prior to 7.13.0, OAuth2 Proxy fails to normalize underscores to dashes in X-Forwarded-* headers. Attackers can inject underscore variants to bypass proxy filtering and escalate privileges in upstream applications that normalize these headers.	CWE-644
X_Forwarded_For	header	/	In versions prior to 7.13.0, OAuth2 Proxy fails to normalize underscores to dashes in X-Forwarded-* headers. Attackers can inject underscore variants to bypass proxy filtering and escalate privileges in upstream applications that normalize these headers.	CWE-644
X_Forwarded_For	header	/	In versions prior to 7.13.0, OAuth2 Proxy fails to normalize underscores to dashes in X-Forwarded-* headers. Attackers can inject underscore variants to bypass proxy filtering and escalate privileges in upstream applications that normalize these headers.	CWE-644

17 Jun 2026 09:54Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.5

EPSS0.00658

SSVC

CWE-644