CVE-2026-40575

CVE-2026-40575 is a critical authentication bypass vulnerability affecting OAuth2 Proxy versions 7.5.0 through 7.15.1. When the reverse proxy mode is enabled alongside skip-auth rules, the application improperly trusts the client-supplied X-Forwarded-Uri header, allowing attackers to spoof this header and bypass authentication checks by manipulating which path OAuth2 Proxy evaluates against its security rules. This vulnerability specifically impacts deployments using the --reverse-proxy flag in combination with --skip-auth-regex or --skip-auth-route configurations. The vulnerability carries a CVSS score of 9.1 (Critical) with an attack vector that is network-based, requires no authentication or user interaction, and presents no special access complexity. The impact is severe, with attackers able to achieve high confidentiality and integrity compromise by gaining unauthorized access to protected routes and sensitive data without valid authentication sessions. The attack requires only standard HTTP manipulation capabilities available to remote, unauthenticated threat actors. Exploitation status indicates this vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on security hot lists, suggesting limited active exploitation in the wild at this time. However, the straightforward nature of the attack—requiring only header manipulation—combined with the high CVSS severity means organizations should treat this as a priority for patching. The vulnerability is patched in version 7.15.2, and multiple workarounds exist for organizations unable to upgrade immediately, including header stripping at the reverse proxy layer and restricting direct client access to OAuth2 Proxy.