CVE-2026-40574

OAuth2 Proxy versions prior to 7.15.2 contain an authorization bypass vulnerability in the email_domain enforcement feature that allows attackers to authenticate using malformed email claims with appended domain syntax (such as [email protected]@company.com) to satisfy domain restrictions intended to permit only legitimate company.com addresses. This vulnerability only affects deployments that enforce email_domain restrictions while accepting email claims from identity providers that do not strictly validate standard email syntax. The flaw enables an attacker with valid login credentials to bypass email domain controls and gain unauthorized access to protected resources. The vulnerability carries a CVSS score of 6.8 (Medium severity) with a network-based attack vector, high complexity, and low privileges required, resulting in high confidentiality and integrity impact but no availability impact. The EPSS score of 0.0004 indicates minimal real-world exploit probability, positioning it below the median in active exploitation likelihood among public vulnerabilities. There is no evidence of active exploitation in the wild, as indicated by its absence from the Known Exploited Vulnerabilities catalog and inactive status on security hotlists. Patches are available through the OAuth2 Proxy 7.15.2 update, and affected organizations should prioritize remediation if they rely on email domain restrictions for access control.