OA
Product
oauth2-proxy
8
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 4High 2Medium 1Low 1
Watch
Add oauth2-proxy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76835 | 9.1 | Aug 24 | OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set Affected: 7.15.2 through 7.15.4 |
| CVE-2026-40575 | 9.1 | Apr 21 | OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing Affected: >= 7.5.0, < 7.15.2 |
| CVE-2026-34457 | 9.1 | Apr 14 | OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode Affected: < 7.15.2 |
| CVE-2025-54576 | 9.1 | Jul 30 | OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion Affected: < 7.11.0 |
| CVE-2025-64484 | 8.5 | Nov 10 | OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation Affected: < 7.13.0 |
| CVE-2026-41059 | 8.2 | Apr 21 | OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex Affected: >= 7.5.0, < 7.15.2 |
| CVE-2026-40574 | 6.8 | Apr 21 | OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims Affected: < 7.15.2 |
| CVE-2026-34454 | 3.5 | Apr 14 | OAuth2 Proxy: Session cookie not cleared when rendering sign-in page Affected: >= 7.11.0, < 7.15.2 |
Showing 8