CVE-2025-64484

CVE-2025-64484 affects OAuth2-Proxy versions prior to 7.13.0, specifically when deployed with upstream applications that normalize underscores to dashes in HTTP headers (e.g., Django, Flask). Authenticated users can bypass proxy filtering by injecting underscore variants of X-Forwarded-* headers, potentially leading to privilege escalation within the upstream application. This vulnerability has a high CVSS score of 8.5, indicating a network-based attack with low complexity and high impact on confidentiality. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.