Forkast·
OAuth2 Proxy Fixed a Header-Spoofing Bypass. Then Its Default Undid the Fix.
7.15.2-7.15.4
affected versions
An unauthenticated remote attacker can bypass authentication in OAuth2 Proxy versions 7.15.2 through 7.15.4 by manipulating the X-Forwarded-Uri header. The vulnerability, tracked as CVE-2026-76835, carries a CVSS score of 9.1 and is…