CVE-2026-76835

🗓️ 24 Aug 2026 17:55:39Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 101 Views🌐 WEB

OAuth2 Proxy auth bypass via X-Forwarded-Uri header spoofing when trusted_proxy_ip is unset.

Reporter	Title	Published	Views	Family All 17
Circl	CVE-2026-76835	24 Aug 202619:01	–	circl
Cvelist	CVE-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set	24 Aug 202617:55	–	cvelist
EUVD	EUVD-2026-65061	24 Aug 202617:55	–	euvd
Mend	CVE-2026-76835	24 Aug 202617:55	–	mend
NVD	CVE-2026-76835	24 Aug 202618:17	–	nvd
osv_bit	BIT-OAUTH2-PROXY-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing	23 Apr 202608:47	–	osv_bit
osv_bit	BIT-OAUTH2-PROXY-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set	25 Sep 202612:27	–	osv_bit
osv_cve	CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing	21 Apr 202623:20	–	osv_cve
osv_ghsa	GHSA-7X63-XV5R-3P2X OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing	15 Apr 202619:21	–	osv_ghsa
osv_go	GO-2026-5236 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy	25 Jun 202618:43	–	osv_go

Vulners

CNA

Node

oauth2-proxy oauth2-proxyRange7.15.2–7.15.4

[
  {
    "vendor": "oauth2-proxy",
    "product": "oauth2-proxy",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.15.2",
        "lessThanOrEqual": "7.15.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "repo": "https://github.com/oauth2-proxy/oauth2-proxy",
    "packageURL": "pkg:golang/github.com/oauth2-proxy/oauth2-proxy/v7"
  }
]

Source	Link
github	www.github.com/oauth2-proxy/oauth2-proxy/issues/3506
github	www.github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/pkg/apis/middleware/scope.go
vulncheck	www.vulncheck.com/advisories/oauth2-proxy-through-authentication-bypass-via-x-forwarded-uri-under-the-default-trusted-proxy-set
github	www.github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x
github	www.github.com/oauth2-proxy/oauth2-proxy

Parameter	Position	Path	Description	CWE
X-Forwarded-Uri	header	/<any_protected_path>	An unauthenticated attacker can bypass authentication by providing a spoofed X-Forwarded-Uri header that matches a skip_auth_route, while the actual request path remains a protected resource.	CWE-290

13 Oct 2026 09:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.1

CVSS 49.3

EPSS0.00453

SSVC

CWE-290