CVE-2026-47775 Details

A padding oracle vulnerability has been identified in Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1. The issue arises in the OAuth2 HTTP filter, where the encrypt and decrypt functions utilize AES-256-CBC encryption without an authentication tag, leaving the encryption vulnerable to manipulation. The vulnerability allows an attacker to exploit the /callback endpoint, which returns HTTP 302 for successful decryption and HTTP 401 for padding errors. By intercepting the encrypted CodeVerifier cookie, an attacker can decrypt the PKCE code_verifier in approximately 6,200 requests, or about 100 seconds. This decrypted code_verifier can then be used, in conjunction with a stolen authorization code, to obtain the victim's access token.

Users should update to Envoy versions 1.35.13, 1.36.9, 1.37.5, or 1.38.3. Additionally, the OAuth2 filter's encryption method should be changed from AES-256-CBC to AES-256-GCM to ensure authenticated encryption. The /callback handler should also be modified to return a consistent HTTP status code, regardless of the decryption failure reason, to prevent information leakage.