# CVE-2026-40574: OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims

Source: https://junglewise.ai/threats/cve-2026-40574-oauth2-proxy-has-an-authorization-bypass-in-email-domain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40574 · Severity: medium · CVSS 6.8 · Published 2026-04-21

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Prior to 7.15.2, an authorization bypass exists in OAuth2 Proxy as part of the email_domain enforcement option. An attacker may be able to authenticate with an email claim such as attacker@evil.com@company.com and satisfy an allowed domain check for company.com, even though the claim is not a valid email address. The issue ONLY affects deployments that rely on email_domain restrictions and accept email claim values from identity providers or claim mappings that do not strictly enforce normal email syntax. This vulnerability is fixed in 7.15.2.

Technologies: [github.com/oauth2-proxy/oauth2-proxy (Go)](https://junglewise.ai/threats/technologies/github-com-oauth2-proxy-oauth2-proxy), [github.com/oauth2-proxy/oauth2-proxy/v7 (Go)](https://junglewise.ai/threats/technologies/github-com-oauth2-proxy-oauth2-proxy-v7). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40574 being exploited in the wild.

**How severe is CVE-2026-40574?** Medium severity, with a CVSS score of 6.8, published 21 April 2026.

**Which products and versions are affected?** github.com/oauth2-proxy/oauth2-proxy (Go) SEMVER:introduced=0; github.com/oauth2-proxy/oauth2-proxy/v7 (Go) < 7.15.2, SEMVER:introduced=0,fixed=7.15.2.

**Is there a fix for CVE-2026-40574?** Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40574?** Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or Oauth2 Proxy Project Oauth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later

  ```sh
  go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2
  ```


## Affected products

- github.com/oauth2-proxy/oauth2-proxy (Go) SEMVER:introduced=0
- github.com/oauth2-proxy/oauth2-proxy/v7 (Go) < 7.15.2, SEMVER:introduced=0,fixed=7.15.2
- Oauth2 Proxy Project Oauth2 Proxy

## Identifiers

- CVE-2026-40574
- GHSA-c5c4-8r6x-56w3
- GO-2026-5314

## References

- [https://api.github.com/users/kodareef5](https://api.github.com/users/kodareef5)
- [https://github.com/kodareef5](https://github.com/kodareef5)
- [https://api.github.com/users/kodareef5/gists%7B/gist_id%7D](https://api.github.com/users/kodareef5/gists%7B/gist_id%7D)
- [https://api.github.com/users/kodareef5/repos](https://api.github.com/users/kodareef5/repos)
- [https://avatars.githubusercontent.com/u/261977334?v=4](https://avatars.githubusercontent.com/u/261977334?v=4)
- [https://api.github.com/users/kodareef5/events%7B/privacy%7D](https://api.github.com/users/kodareef5/events%7B/privacy%7D)

## Related threats

- [OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex](https://junglewise.ai/threats/cve-2026-41059-oauth2-proxy-has-an-authentication-bypass-via-fragment-confusion)
- [OAuth2 Proxy authentication bypass via X-Forwarded-Uri spoofing](https://junglewise.ai/threats/cve-2026-40575-oauth2-proxy-authentication-bypass-via-x-forwarded-uri-spoofing)
- [OAuth2 Proxy authentication bypass via health check User-Agent spoofing](https://junglewise.ai/threats/cve-2026-34457-oauth2-proxy-authentication-bypass-via-health-check-user-agent)
- [OAuth2 Proxy insufficient session expiration in sign-in page handler](https://junglewise.ai/threats/cve-2026-34454-oauth2-proxy-insufficient-session-expiration-in-sign-in-page)
- [OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation](https://junglewise.ai/threats/cve-2025-64484-oauth2-proxy-is-vulnerable-to-header-smuggling-via-underscore)