CVE-2026-34457 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
Unauthenticated attackers can bypass authentication in OAuth2 Proxy auth_request mode by spoofing health check User-Agents when specific flags are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34457?
CVE-2026-34457 is a critical authentication bypass vulnerability in oauth2-proxy, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health check regardless of the requested path, allowing an unauthenticated remote attacker to bypass authentication and access protected upstream resources. Deployments that do not use auth_request-style subrequests or that do not enable --ping-user-agent/--gcp-healthchecks are not affected. This issue is fixed in 7.15.2.
Weakness: CWE-290
Which versions are affected by CVE-2026-34457?
7 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy, oauth2-proxy and github.com/oauth2-proxy/oauth2-proxy/v7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/oauth2-proxy/oauth2-proxy Go | All versions | None |
github.com/oauth2-proxy/oauth2-proxy Go | All versions to 3.2.0 | None |
github.com/oauth2-proxy/oauth2-proxy Go | All versions to 3.2.0 | None |
oauth2-proxy Bitnami | All versions | 7.15.2 |
github.com/oauth2-proxy/oauth2-proxy/v7 Go | All versions | 7.15.2 |
github.com/oauth2-proxy/oauth2-proxy/v7 Go | All versions | 7.15.2 |
1 more packages
github.com/oauth2-proxy/oauth2-proxy/v7 Go | All versions | 7.15.2 |
Products include Oauth2 Proxy Project Oauth2 Proxy.
How do I fix CVE-2026-34457?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-34457 being exploited?
There is no known exploitation of CVE-2026-34457 in the wild and no public exploit code.
Other vulnerabilities in oauth2-proxy
- CVE-2026-40575 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
- CVE-2025-54576 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
- CVE-2017-1000069 Cross-site Request Forgery (CSRF)
- CVE-2026-41059 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
- CVE-2020-11053 Open Redirect in OAuth2 Proxy
Sources
Also known as BIT-oauth2-proxy-2026-34457, GHSA-5hvv-m4w4-gf6v, GO-2026-5147, MINI-5m2r-3wg8-6964, MINI-8647-68qr-gw3v.