CVE-2026-34457 Details
Description
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health check regardless of the requested path, allowing an unauthenticated remote attacker to bypass authentication and access protected upstream resources. Deployments that do not use auth_request-style subrequests or that do not enable --ping-user-agent/--gcp-healthchecks are not affected. This issue is fixed in 7.15.2.
A critical authentication bypass vulnerability has been identified in OAuth2 Proxy versions prior to 7.15.2. This issue arises in configurations using an 'auth_request' integration, such as with nginx, where the '--ping-user-agent' option is enabled or Google Cloud Platform health checks are active. In these scenarios, OAuth2 Proxy incorrectly validates requests with the health check User-Agent as successful, allowing unauthenticated remote attackers to access protected resources without going through the normal authentication process. Deployments not using 'auth_request' subrequests or those that do not enable the relevant user-agent options are not affected.
Users should upgrade to OAuth2 Proxy version 7.15.2 or later. For those using versions prior to 7.15.2 with 'auth_request' authentication, the vulnerability can be mitigated by disabling '--gcp-healthchecks', removing any configured '--ping-user-agent', ensuring the reverse proxy does not forward client-controlled User-Agent headers to the OAuth2 Proxy auth subrequest, and using path-based health checks on dedicated health check endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.2 | [email protected] | Release Notes |
| https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oauth2 proxy project oauth2 proxy | < 7.15.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |