CVE-2026-34457

CVE-2026-34457 is a configuration-dependent authentication bypass vulnerability in OAuth2 Proxy versions prior to 7.15.2. The flaw affects deployments using auth_request-style integration (such as nginx auth_request) with either the --ping-user-agent option enabled or --gcp-healthchecks enabled. In these configurations, OAuth2 Proxy incorrectly treats requests matching the configured health check User-Agent as successful authentication regardless of the requested path, allowing unauthenticated attackers to bypass authentication controls and access protected resources. The vulnerability carries a critical CVSS 3.1 score of 9.1 with a network-based attack vector requiring low complexity and no privileges or user interaction. The attack has high impact on both confidentiality and integrity, as it enables direct access to protected upstream resources without authentication. The issue is configuration-dependent, affecting only deployments that combine auth_request-style subrequests with health check mechanisms. Exploitation status remains limited based on available indicators. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows low EPSS prevalence scoring, indicating minimal real-world exploitation activity at present. However, organizations running affected configurations should prioritize upgrading to version 7.15.2 or later, as the attack is trivial to execute once the vulnerable configuration is identified.