{"uuid": "7620d508-5abb-4fb2-9955-ee398f488db2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7x63-xv5r-3p2x", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117151994205661813", "content": "\nOAuth2 Proxy may trust a client-supplied X-Forwarded-Uri header when --reverse-proxy is enabled and --skip-auth-route or --skip-auth-regex is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application.\nThis can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.\nhttps://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x", "creation_timestamp": "2026-08-24T18:52:50.104305Z"}