CVE-2026-49332 Details

A vulnerability exists in Red Hat OpenShift OAuth Proxy that allows authenticated low-privilege users to smuggle forged identity headers. The proxy only sets authenticated identity using dash-variant keys (X-Forwarded-User) and fails to remove underscore-variant keys (X_Forwarded_User) from incoming requests. This discrepancy can be exploited, as WSGI and PHP frameworks normalize both variants to the same variable. The issue enables an attacker to override legitimate authenticated identities in the upstream application.

Upstream applications should validate the X-Forwarded-User header against the expected session identity and reject requests where the headers do not match.