CVE-2026-41059 - Vulnerability Analysis

Overview

OAuth2 Proxy 7.5.0 through 7.15.1 contains an authentication bypass caused by improper normalization of request paths with skip_auth_routes or skip_auth_regex patterns, letting unauthenticated attackers access protected resources, exploit requires use of vulnerable skip-auth configurations with fragment delimiters.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication to access protected resources, risking unauthorized data exposure.

Mitigation

Upgrade to version 7.15.2 or later; alternatively, tighten or remove skip_auth_routes and skip_auth_regex rules and reject requests containing '%23' or '#' at ingress.

References

• https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner