# CVE-2026-41059: OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex

Source: https://junglewise.ai/threats/cve-2026-41059-oauth2-proxy-has-an-authentication-bypass-via-fragment-confusion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-41059 · Severity: high · CVSS 8.2 · Published 2026-04-22

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-dependent authentication bypass. Deployments are affected when all of the following are true: Use of `skip_auth_routes` or the legacy `skip_auth_regex`; use of patterns that can be widened by attacker-controlled suffixes, such as `^/foo/.*/bar$` causing potential exposure of `/foo/secret`; and protected upstream applications that interpret `#` as a fragment delimiter or otherwise route the request to the protected base path. In deployments that rely on these settings, an unauthenticated attacker can send a crafted request containing a number sign in the path, including the browser-safe encoded form `%23`, so that OAuth2 Proxy matches a public allowlist rule while the backend serves a protected resource. Deployments that do not use these skip-auth options, or that only allow exact public paths with tightly scoped method and path rules, are not affected. A fix has been implemented in version 7.15.2 to normalize request paths more conservatively before skip-auth matching so fragment content does not influence allowlist decisions. Users who cannot upgrade immediately can reduce exposure by tightening or removing `skip_auth_routes` and `skip_auth_regex` rules, especially patterns that use broad wildcards across path segments. Recommended mitigations include replacing broad rules with exact, anchored public paths and explicit HTTP methods; rejecting requests whose path contains `%23` or `#` at the ingress, load balancer, or WAF level; and/or avoiding placing sensitive application paths behind broad `skip_auth_routes` rules.

Technologies: [github.com/oauth2-proxy/oauth2-proxy (Go)](https://junglewise.ai/threats/technologies/github-com-oauth2-proxy-oauth2-proxy), [github.com/oauth2-proxy/oauth2-proxy/v7 (Go)](https://junglewise.ai/threats/technologies/github-com-oauth2-proxy-oauth2-proxy-v7). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-41059 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41059 being exploited in the wild.

**How severe is CVE-2026-41059?** High severity, with a CVSS score of 8.2, published 22 April 2026.

**Which products and versions are affected?** github.com/oauth2-proxy/oauth2-proxy (Go) SEMVER:introduced=0; github.com/oauth2-proxy/oauth2-proxy/v7 (Go) >= 7.5.0, < 7.15.2, SEMVER:introduced=7.5.0,fixed=7.15.2.

**Is there a fix for CVE-2026-41059?** Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-41059?** Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or Oauth2 Proxy Project Oauth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later

  ```sh
  go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2
  ```


## Affected products

- github.com/oauth2-proxy/oauth2-proxy (Go) SEMVER:introduced=0
- github.com/oauth2-proxy/oauth2-proxy/v7 (Go) >= 7.5.0, < 7.15.2, SEMVER:introduced=7.5.0,fixed=7.15.2
- Oauth2 Proxy Project Oauth2 Proxy

## Identifiers

- CVE-2026-41059
- GHSA-pxq7-h93f-9jrg
- GO-2026-5559

## References

- [https://api.github.com/users/rootxharsh](https://api.github.com/users/rootxharsh)
- [https://github.com/rootxharsh](https://github.com/rootxharsh)
- [https://api.github.com/users/rootxharsh/gists%7B/gist_id%7D](https://api.github.com/users/rootxharsh/gists%7B/gist_id%7D)
- [https://api.github.com/users/rootxharsh/repos](https://api.github.com/users/rootxharsh/repos)
- [https://avatars.githubusercontent.com/u/21000421?v=4](https://avatars.githubusercontent.com/u/21000421?v=4)
- [https://api.github.com/users/rootxharsh/events%7B/privacy%7D](https://api.github.com/users/rootxharsh/events%7B/privacy%7D)

## Related threats

- [OAuth2 Proxy authentication bypass via X-Forwarded-Uri spoofing](https://junglewise.ai/threats/cve-2026-40575-oauth2-proxy-authentication-bypass-via-x-forwarded-uri-spoofing)
- [OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims](https://junglewise.ai/threats/cve-2026-40574-oauth2-proxy-has-an-authorization-bypass-in-email-domain)
- [OAuth2 Proxy authentication bypass via health check User-Agent spoofing](https://junglewise.ai/threats/cve-2026-34457-oauth2-proxy-authentication-bypass-via-health-check-user-agent)
- [OAuth2 Proxy insufficient session expiration in sign-in page handler](https://junglewise.ai/threats/cve-2026-34454-oauth2-proxy-insufficient-session-expiration-in-sign-in-page)
- [OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation](https://junglewise.ai/threats/cve-2025-64484-oauth2-proxy-is-vulnerable-to-header-smuggling-via-underscore)