CVE-2026-34457: oauth2_proxy_project oauth2_proxy Authentication Bypass by Spoofing

Vulnerability summary

CVE-2026-34457 is a critical (CVSS 9.1) Authentication Bypass by Spoofing vulnerability in oauth2_proxy_project oauth2_proxy. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.7% of scored vulnerabilities.

Timeline

1. 14-04-2026
   PublishedVulnerability first disclosed.
2. 15-04-2026
   Last modifiedVulnerability information updated.

Description

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health check regardless of the requested path, allowing an unauthenticated remote attacker to bypass authentication and access protected upstream resources. Deployments that do not use auth_request-style subrequests or that do not enable --ping-user-agent/--gcp-healthchecks are not affected. This issue is fixed in 7.15.2.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.