# CVE-2026-34457: OAuth2 Proxy authentication bypass via health check User-Agent spoofing

Source: https://junglewise.ai/threats/cve-2026-34457-oauth2-proxy-authentication-bypass-via-health-check-user-agent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34457 · Severity: critical · CVSS 9.1 · Published 2026-04-14

OAuth2 Proxy, a tool used to secure web applications by requiring login via providers like Google or GitHub, contains a flaw that allows attackers to bypass security checks. By mimicking a specific "User-Agent" string used for system health monitoring, an unauthorized user can gain full access to protected internal resources without logging in. This could lead to the exposure of sensitive customer data or unauthorized access to internal corporate tools.

Technologies: [github.com/oauth2-proxy/oauth2-proxy (Go)](https://junglewise.ai/threats/technologies/github-com-oauth2-proxy-oauth2-proxy), [github.com/oauth2-proxy/oauth2-proxy/v7 (Go)](https://junglewise.ai/threats/technologies/github-com-oauth2-proxy-oauth2-proxy-v7), [OAuth2 Proxy](https://junglewise.ai/threats/technologies/oauth2-proxy). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OAuth2 Proxy](https://junglewise.ai/threats/vendors/oauth2-proxy).

## Quick answers

**Is CVE-2026-34457 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34457 being exploited in the wild.

**How severe is CVE-2026-34457?** Critical severity, with a CVSS score of 9.1, published 14 April 2026.

**Which products and versions are affected?** github.com/oauth2-proxy/oauth2-proxy (Go) <= 3.2.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.2.0; github.com/oauth2-proxy/oauth2-proxy/v7 (Go) < 7.15.2, SEMVER:introduced=0,fixed=7.15.2; OAuth2 Proxy < 7.15.2.

**Is there a fix for CVE-2026-34457?** Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34457 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34457?** Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later

  ```sh
  go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2
  ```


## Technical details

An authentication bypass exists in OAuth2 Proxy versions prior to 7.15.2 due to improper validation of health check requests. When configured with an auth_request-style integration (e.g., Nginx auth_request) and either --ping-user-agent or --gcp-healthchecks enabled, the proxy incorrectly treats any request containing the designated health check User-Agent as a valid, authenticated session. This occurs regardless of the requested URL path. An unauthenticated remote attacker can exploit this by spoofing the User-Agent header to match the configured health check string, thereby bypassing the OAuth2 flow and accessing upstream protected resources. The issue is resolved in version 7.15.2.

## Affected products

- OAuth2 Proxy Project OAuth2 Proxy < 7.15.2

## Identifiers

- CVE-2026-34457
- GHSA-5hvv-m4w4-gf6v
- GO-2026-5147

## Timeline

- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in version 7.15.2
- 2026-04-14: advisory

## References

- [https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.2](https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.2)
- [https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v)

## Related threats

- [OAuth2 Proxy authentication bypass via spoofed X-Forwarded-Uri header](https://junglewise.ai/threats/cve-2026-76835-oauth2-proxy-authentication-bypass-via-spoofed-x-forwarded-uri)
- [OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex](https://junglewise.ai/threats/cve-2026-41059-oauth2-proxy-has-an-authentication-bypass-via-fragment-confusion)
- [OAuth2 Proxy authentication bypass via X-Forwarded-Uri spoofing](https://junglewise.ai/threats/cve-2026-40575-oauth2-proxy-authentication-bypass-via-x-forwarded-uri-spoofing)
- [OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims](https://junglewise.ai/threats/cve-2026-40574-oauth2-proxy-has-an-authorization-bypass-in-email-domain)
- [OAuth2 Proxy insufficient session expiration in sign-in page handler](https://junglewise.ai/threats/cve-2026-34454-oauth2-proxy-insufficient-session-expiration-in-sign-in-page)