CVE-2026-41059 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex

High 8.2 Published 21 Apr 2026 Updated 22 Apr 2026

Unauthenticated attackers can bypass authentication in OAuth2 Proxy deployments using broad skip-auth regex rules by exploiting fragment confusion to access protected resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-41059?

CVE-2026-41059 is a high-severity authentication bypass vulnerability in oauth2-proxy, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-dependent authentication bypass. Deployments are affected when all of the following are true: Use of `skip_auth_routes` or the legacy `skip_auth_regex`; use of patterns that can be widened by attacker-controlled suffixes, such as `^/foo/.*/bar$` causing potential exposure of `/foo/secret`; and protected upstream applications that interpret `#` as a fragment delimiter or otherwise route the request to the protected base path. In deployments that rely on these settings, an unauthenticated attacker can send a crafted request containing a number sign in the path, including the browser-safe encoded form `%23`, so that OAuth2 Proxy matches a public allowlist rule while the backend serves a protected resource. Deployments that do not use these skip-auth options, or that only allow exact public paths with tightly scoped method and path rules, are not affected. A fix has been implemented in version 7.15.2 to normalize request paths more conservatively before skip-auth matching so fragment content does not influence allowlist decisions. Users who cannot upgrade immediately can reduce exposure by tightening or removing `skip_auth_routes` and `skip_auth_regex` rules, especially patterns that use broad wildcards across path segments. Recommended mitigations include replacing broad rules with exact, anchored public paths and explicit HTTP methods; rejecting requests whose path contains `%23` or `#` at the ingress, load balancer, or WAF level; and/or avoiding placing sensitive application paths behind broad `skip_auth_routes` rules.

Weakness: CWE-288

Which versions are affected by CVE-2026-41059?

5 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy/v7, oauth2-proxy and github.com/oauth2-proxy/oauth2-proxy. It affects 1 product.

Package	Affected	Fixed in
`github.com/oauth2-proxy/oauth2-proxy/v7` Go	From `7.5.0`	`7.15.2`
`github.com/oauth2-proxy/oauth2-proxy/v7` Go	From `7.5.0`	`7.15.2`
`github.com/oauth2-proxy/oauth2-proxy/v7` Go	From `7.5.0`	`7.15.2`
`oauth2-proxy` Bitnami	From `7.5.0`	`7.15.2`
`github.com/oauth2-proxy/oauth2-proxy` Go	All versions	None

Products include Oauth2 Proxy Project Oauth2 Proxy.

How do I fix CVE-2026-41059?

Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.15.2 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-41059 being exploited?

There is no known exploitation of CVE-2026-41059 in the wild and no public exploit code.

Sources

Also known as BIT-oauth2-proxy-2026-41059, GHSA-pxq7-h93f-9jrg, GO-2026-5559, MINI-3wc2-hw99-vv3j, MINI-8274-3ph2-7xx8.