{"id":"GHSA-pxq7-h93f-9jrg","summary":"OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex","details":"### Impact\n\nA configuration-dependent authentication bypass exists in OAuth2 Proxy.\n\nDeployments are affected when all of the following are true:\n\n* Use of `skip_auth_routes` or the legacy `skip_auth_regex` * Use of patterns that can be widened by attacker-controlled suffixes,    such as `^/foo/.*/bar$` causing potential exposure of `/foo/secret` * Protected upstream applications that interpret `#` as a fragment delimiter    or otherwise route the request to the protected base path\n\nIn deployments that rely on these settings, an unauthenticated attacker can send a crafted request containing a number sign in the path, including the browser-safe encoded form `%23`, so that OAuth2 Proxy matches a public allowlist rule while the backend serves a protected resource.\n\nDeployments that do not use these skip-auth options, or that only allow exact public paths with tightly scoped method and path rules, **ARE NOT** affected.\n\n### Patches\n\nA fix has been implemented to normalize request paths more conservatively before skip-auth matching so fragment content does not influence allowlist decisions.\n\nReleased as part of `v7.15.2`\n\n### Workarounds\n\nUsers who cannot upgrade immediately can reduce exposure by tightening or removing `skip_auth_routes` and `skip_auth_regex` rules, especially patterns that use broad wildcards across path segments.\n\nRecommended mitigations:\n\n* Replace broad rules with exact, anchored public paths and explicit HTTP methods\n* Reject requests whose path contains `%23` or `#` at the ingress, load balancer, or WAF level\n* Avoid placing sensitive application paths behind broad `skip_auth_routes` rules","aliases":["BIT-oauth2-proxy-2026-41059","CVE-2026-41059","GO-2026-5559"],"modified":"2026-06-25T23:11:56.369333259Z","published":"2026-04-15T19:24:13Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-04-15T19:24:13Z","nvd_published_at":"2026-04-22T00:16:27Z","cwe_ids":["CWE-288"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41059"},{"type":"PACKAGE","url":"https://github.com/oauth2-proxy/oauth2-proxy"}],"affected":[{"package":{"name":"github.com/oauth2-proxy/oauth2-proxy/v7","ecosystem":"Go","purl":"pkg:golang/github.com/oauth2-proxy/oauth2-proxy/v7"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.5.0"},{"fixed":"7.15.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-pxq7-h93f-9jrg/GHSA-pxq7-h93f-9jrg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}]}