Is CVE-2026-76835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76835 being exploited in the wild.

How severe is CVE-2026-76835?

Critical severity, with a CVSS score of 9.1, published 22 April 2026.

Which products and versions are affected?

github.com/oauth2-proxy/oauth2-proxy (Go) SEMVER:introduced=0; github.com/oauth2-proxy/oauth2-proxy/v7 (Go) >= 7.5.0, = 7.5.0, < 7.15.2.

Is there a fix for CVE-2026-76835?

Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76835 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76835?

Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76835: OAuth2 Proxy authentication bypass via X-Forwarded-Uri spoofing

Q: Is there a fix for CVE-2026-76835?

Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-76835 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-76835?

Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76835 · Severity: critical · CVSS 9.1 · Published 2026-04-22

OAuth2 Proxy, a tool used to provide authentication for web applications, contains a flaw that allows attackers to bypass security checks. By sending specially crafted web requests, an unauthorized user can trick the system into granting access to protected areas without a valid login. This could lead to the exposure of sensitive internal data or unauthorized access to corporate applications.

Technologies: github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go), OAuth2 Proxy. Vendors: Go, OAuth2 Proxy.

Quick answers

Is CVE-2026-76835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76835 being exploited in the wild.
How severe is CVE-2026-76835?: Critical severity, with a CVSS score of 9.1, published 22 April 2026.
Which products and versions are affected?: github.com/oauth2-proxy/oauth2-proxy (Go) SEMVER:introduced=0; github.com/oauth2-proxy/oauth2-proxy/v7 (Go) >= 7.5.0, < 7.15.2, SEMVER:introduced=7.5.0,fixed=7.15.2; OAuth2 Proxy >= 7.5.0, < 7.15.2.
Is there a fix for CVE-2026-76835?: Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76835 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76835?: Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later
```
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2
```

Technical details

An authentication bypass (CWE-290) exists in OAuth2 Proxy due to improper handling of the X-Forwarded-Uri header. When the --reverse-proxy flag is enabled alongside --skip_auth_routes or --skip-auth-regex, the application may trust client-supplied headers to evaluate authentication rules. An unauthenticated remote attacker can spoof this header to make the proxy believe the request is for a path that does not require authentication, while the request is actually forwarded to a protected upstream path. The issue is addressed in version 7.15.2 by introducing the --trusted-proxy-ip flag to restrict which source IPs can provide forwarded headers.

Affected products

OAuth2 Proxy OAuth2 Proxy >= 7.5.0, < 7.15.2

Identifiers

CVE-2026-76835
CVE-2026-40575
GHSA-7x63-xv5r-3p2x
GO-2026-5236

Timeline

2026-04-14: disclosed: Reported to oauth2-proxy/oauth2-proxy
2026-04-15: advisory: GitHub Advisory published
2026-04-22: other: Published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.