# CVE-2026-76835: OAuth2 Proxy authentication bypass via spoofed X-Forwarded-Uri header

Source: https://junglewise.ai/threats/cve-2026-76835-oauth2-proxy-authentication-bypass-via-spoofed-x-forwarded-uri  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76835 · Severity: critical · CVSS 9.1 · Published 2026-08-24

OAuth2 Proxy is a reverse proxy that enforces authentication before allowing access to protected applications. An unauthenticated attacker can bypass this protection by supplying a forged X-Forwarded-Uri HTTP header that matches an allowed authentication-skip route, causing the proxy to permit access to protected upstream services. The proxy grants all clients "trusted proxy" status by default, making every external request eligible for header spoofing.

Technologies: [OAuth2 Proxy](https://junglewise.ai/threats/technologies/oauth2-proxy). Vendors: [OAuth2 Proxy](https://junglewise.ai/threats/vendors/oauth2-proxy).

## Quick answers

**Is CVE-2026-76835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76835 being exploited in the wild.

**How severe is CVE-2026-76835?** Critical severity, with a CVSS score of 9.1, published 24 August 2026.

**Which products and versions are affected?** OAuth2 Proxy before fix for CVE-2026-76835.

**Is there a fix for CVE-2026-76835?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76835 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76835?** Check whether you run OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OAuth2 Proxy validates whether a request should skip authentication by comparing the request path against a skip-auth allow list (skip_auth_routes and skip_auth_regex). However, GetRequestURI in pkg/requests/util/util.go prefers the X-Forwarded-Uri header over the actual request URI when CanTrustForwardedHeaders returns true. The CanTrustForwardedHeaders function in pkg/apis/middleware/scope.go treats a caller as a trusted proxy if its address is in the TrustedProxies set, which defaults to 0.0.0.0/0 and ::/0 when reverse proxy mode is enabled without explicit trusted_proxy_ip configuration. This means every network client is considered trusted. An attacker sends a request to a protected path while setting X-Forwarded-Uri to a value matching an allow-listed route; the authentication skip decision is made against the spoofed header value, but the upstream service receives the actual protected path unchanged, resulting in unauthorized access. The fix for CVE-2026-40575 is ineffective in the default configuration.

## Affected products

- OAuth2 Proxy OAuth2 Proxy before fix for CVE-2026-76835

## Timeline

- 2026-08-24: disclosed

## References

- [https://github.com/oauth2-proxy/oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy)
- [https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/pkg/apis/middleware/scope.go](https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/pkg/apis/middleware/scope.go)

## Related threats

- [OAuth2 Proxy authentication bypass via X-Forwarded-Uri spoofing](https://junglewise.ai/threats/cve-2026-40575-oauth2-proxy-authentication-bypass-via-x-forwarded-uri-spoofing)
- [OAuth2 Proxy authentication bypass via health check User-Agent spoofing](https://junglewise.ai/threats/cve-2026-34457-oauth2-proxy-authentication-bypass-via-health-check-user-agent)
- [OAuth2 Proxy insufficient session expiration in sign-in page handler](https://junglewise.ai/threats/cve-2026-34454-oauth2-proxy-insufficient-session-expiration-in-sign-in-page)