BIT-OAUTH2-PROXY-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

CVE-2026-76835: Authentication Bypass by Spoofing

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

Malicious code in requests-util (PyPI)

--- Credit: OpenSSF source...

MAL-2025-41746 Malicious code in requests-util (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in requests-util (PyPI)

--- -= Per source details. Do not edit below this line.=-...