https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:07:17 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291479 EUVD-2026-291479 https://cve.radiocsirt.org/vuln/euvd-2026-291479 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34457 <p>OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health check regardless of the requested path, allowing an unauthenticated remote attacker to bypass authentication and access protected upstream resources. Deployments that do not use auth_request-style subrequests or that do not enable --ping-user-agent/--gcp-healthchecks are not affected. This issue is fixed in 7.15.2.</p> <p>OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health check regardless of the requested path, allowing an unauthenticated remote attacker to bypass authentication and access protected upstream resources. Deployments that do not use auth_request-style subrequests or that do not enable --ping-user-agent/--gcp-healthchecks are not affected. This issue is fixed in 7.15.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34457 https://cve.radiocsirt.org/vuln/ghsa-5hvv-m4w4-gf6v <p><strong>Affected:</strong> Go: github.com/oauth2-proxy/oauth2-proxy/v7, Go: github.com/oauth2-proxy/oauth2-proxy</p> <p>### Impact A configuration-dependent authentication bypass exists in OAuth2 Proxy.</p> <p>Deployments are affected when all of the following are true:</p> <p>- OAuth2 Proxy is used with an `auth_request`-style integration (for example, nginx `auth_request`) - `--ping-user-agent` is set or `--gcp-healthchecks` is enabled</p> <p>In affected configurations, OAuth2 Proxy will treat a request with the configured health check `User-Agent` value as a successful health check regardless of the requested path. This allows an unauthenticated remote attacker to bypass authentication and access protected upstream resources without completing the normal login flow.</p> <p>This issue does not affect deployments that do not use `auth_request`-style subrequests, or that do not enable `--ping-user-agent`/`--gcp-healthchecks`.</p> <p>### Patches Users should upgrade to `v7.15.2` or later once available. Deployments running versions prior to `v7.15.2` should be considered affected if they use `auth_request`-style authentication together with `--ping-user-agent` or `--gcp-healthchecks`.</p> <p>### Workarounds Users can mitigate this issue by:</p> <p>- disabling `--gcp-healthchecks` - removing any configured `--ping-user-agent` - ensuring the reverse proxy does not forward client-controlled `User-Agent` headers to the OAuth2 Proxy auth subrequest - using path-based health checks only, on dedicated health check endpoints</p> <p>Example nginx mitigation for the auth subrequest:</p> <p>```nginx location = /oauth2/auth { internal; proxy_pas…</p> <p><strong>Affected:</strong> Go: github.com/oauth2-proxy/oauth2-proxy/v7, Go: github.com/oauth2-proxy/oauth2-proxy</p> <p>### Impact A configuration-dependent authentication bypass exists in OAuth2 Proxy.</p> <p>Deployments are affected when all of the following are true:</p> <p>- OAuth2 Proxy is used with an `auth_request`-style integration (for example, nginx `auth_request`) - `--ping-user-agent` is set or `--gcp-healthchecks` is enabled</p> <p>In affected configurations, OAuth2 Proxy will treat a request with the configured health check `User-Agent` value as a successful health check regardless of the requested path. This allows an unauthenticated remote attacker to bypass authentication and access protected upstream resources without completing the normal login flow.</p> <p>This issue does not affect deployments that do not use `auth_request`-style subrequests, or that do not enable `--ping-user-agent`/`--gcp-healthchecks`.</p> <p>### Patches Users should upgrade to `v7.15.2` or later once available. Deployments running versions prior to `v7.15.2` should be considered affected if they use `auth_request`-style authentication together with `--ping-user-agent` or `--gcp-healthchecks`.</p> <p>### Workarounds Users can mitigate this issue by:</p> <p>- disabling `--gcp-healthchecks` - removing any configured `--ping-user-agent` - ensuring the reverse proxy does not forward client-controlled `User-Agent` headers to the OAuth2 Proxy auth subrequest - using path-based health checks only, on dedicated health check endpoints</p> <p>Example nginx mitigation for the auth subrequest:</p> <p>```nginx location = /oauth2/auth { internal; proxy_pas…</p> https://cve.radiocsirt.org/vuln/ghsa-5hvv-m4w4-gf6v