Listen to this Post
How the Mentioned CVE Works
The vulnerability stems from a flaw in how OAuth2 Proxy processes URL fragments () within request paths. When skip_auth_routes or skip_auth_regex is configured with broad regex patterns (e.g., ^/foo/./bar$), the proxy incorrectly matches the fragment as part of the path for allowlist decisions. An unauthenticated attacker can append a fragment () or its encoded form (%23) to a request path, such as /foo/secret%23/bar. The proxy treats the fragment as path data, matching the allowlist rule (e.g., ^/foo/./bar$) and thus skipping authentication. However, the upstream application interprets as a fragment delimiter and routes the request to the protected base path (/foo/secret). This discrepancy between the proxy’s path interpretation and the upstream’s fragment handling allows the attacker to bypass authentication entirely and access protected resources. The issue is configuration-dependent and only affects deployments using vulnerable skip-auth patterns with broad wildcards. Deployments that use exact path matching or do not use skip-auth options are not impacted. The fix normalizes request paths before skip-auth matching, removing fragment content from consideration. The vulnerability was addressed in OAuth2 Proxy v7.15.2.
dailycve form
Platform: OAuth2 Proxy
Version: 7.5.0-7.15.1
Vulnerability: Authentication Bypass
Severity: High
date: 2026-04-15
Prediction: 2026-04-14
What Undercode Say:
Check OAuth2 Proxy version ./oauth2-proxy --version Test for vulnerability (example) curl -v "http://target.com/foo/secret%23/bar" Simulate a protected endpoint curl -v "http://target.com/api/admin%23/status" Use encoded fragment to bypass curl -v "http://target.com/private%23/public"
Exploit:
1. Identify a skip_auth_route pattern like `^/public/./static$`
- Craft a request targeting a protected path, e.g., `/private/data`
3. Append `%23/static` to the path: `/private/data%23/static`
- OAuth2 Proxy matches `/private/data%23/static` against
^/public/./static$, which succeeds due to the suffix - Proxy skips authentication and forwards request to upstream
- Upstream interprets “ as fragment, stripping it, and serves `/private/data`
Protection from this CVE
– Upgrade to OAuth2 Proxy v7.15.2 or later
– Replace broad regex patterns with exact path matches
– Reject requests containing “ or `%23` at the WAF or ingress level
– Remove or tighten `skip_auth_routes` and `skip_auth_regex` rules
– Avoid placing sensitive paths behind broad allowlist rules
Impact:
- Unauthenticated attackers can access protected resources
- Bypass of all authentication mechanisms enforced by OAuth2 Proxy
- Potential exposure of sensitive data, admin panels, or internal APIs
- Complete compromise of upstream application security if misconfigured
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
