CVE-2026-49332

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...