# CVE-2026-41059: OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex > Unauthenticated attackers can bypass authentication in OAuth2 Proxy deployments using broad skip-auth regex rules by exploiting fragment confusion to access protected resources. - **Severity:** High 8.2 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 21 Apr 2026 - **Updated:** 22 Apr 2026 - **Also known as:** BIT-oauth2-proxy-2026-41059, GHSA-pxq7-h93f-9jrg, GO-2026-5559, MINI-3wc2-hw99-vv3j, MINI-8274-3ph2-7xx8 ## What is CVE-2026-41059? CVE-2026-41059 is a high-severity authentication bypass vulnerability in oauth2-proxy, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-dependent authentication bypass. Deployments are affected when all of the following are true: Use of `skip_auth_routes` or the legacy `skip_auth_regex`; use of patterns that can be widened by attacker-controlled suffixes, such as `^/foo/.*/bar$` causing potential exposure of `/foo/secret`; and protected upstream applications that interpret `#` as a fragment delimiter or otherwise route the request to the protected base path. In deployments that rely on these settings, an unauthenticated attacker can send a crafted request containing a number sign in the path, including the browser-safe encoded form `%23`, so that OAuth2 Proxy matches a public allowlist rule while the backend serves a protected resource. Deployments that do not use these skip-auth options, or that only allow exact public paths with tightly scoped method and path rules, are not affected. A fix has been implemented in version 7.15.2 to normalize request paths more conservatively before skip-auth matching so fragment content does not influence allowlist decisions. Users who cannot upgrade immediately can reduce exposure by tightening or removing `skip_auth_routes` and `skip_auth_regex` rules, especially patterns that use broad wildcards across path segments. Recommended mitigations include replacing broad rules with exact, anchored public paths and explicit HTTP methods; rejecting requests whose path contains `%23` or `#` at the ingress, load balancer, or WAF level; and/or avoiding placing sensitive application paths behind broad `skip_auth_routes` rules. Weakness: CWE-288 (Authentication Bypass Using an Alternate Path or Channel) ## Which versions are affected by CVE-2026-41059? 5 open source packages ship an affected version, including github.com/oauth2-proxy/oauth2-proxy/v7, oauth2-proxy and github.com/oauth2-proxy/oauth2-proxy. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `github.com/oauth2-proxy/oauth2-proxy/v7` | Go | From 7.5.0 | 7.15.2 | | `github.com/oauth2-proxy/oauth2-proxy/v7` | Go | From 7.5.0 | 7.15.2 | | `github.com/oauth2-proxy/oauth2-proxy/v7` | Go | From 7.5.0 | 7.15.2 | | `oauth2-proxy` | Bitnami | From 7.5.0 | 7.15.2 | | `github.com/oauth2-proxy/oauth2-proxy` | Go | All versions | None | Products: Oauth2 Proxy Project Oauth2 Proxy. ## How do I fix CVE-2026-41059? Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.15.2 or later. ## Is CVE-2026-41059 being exploited? There is no known exploitation of CVE-2026-41059 in the wild and no public exploit code. ## Other vulnerabilities in oauth2-proxy - [CVE-2026-40575](https://insights.sbomify.com/CVE-2026-40575/): OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing (critical 9.1) - [CVE-2026-34457](https://insights.sbomify.com/CVE-2026-34457/): OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode (critical 9.1) - [CVE-2025-54576](https://insights.sbomify.com/CVE-2025-54576/): OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion (critical 9.1) - [CVE-2017-1000069](https://insights.sbomify.com/CVE-2017-1000069/): Cross-site Request Forgery (CSRF) (high 8.8) - [CVE-2020-11053](https://insights.sbomify.com/CVE-2020-11053/): Open Redirect in OAuth2 Proxy (high 7.1) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-41059 and fix it if it is affected. What it is: CVE-2026-41059 is a high-severity authentication bypass vulnerability in oauth2-proxy, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-41059 in the wild and no public exploit code. Affected packages and fixed versions: - github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected from 7.5.0; fixed in 7.15.2 - github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected from 7.5.0; fixed in 7.15.2 - github.com/oauth2-proxy/oauth2-proxy/v7 (Go): affected from 7.5.0; fixed in 7.15.2 - oauth2-proxy (Bitnami): affected from 7.5.0; fixed in 7.15.2 - github.com/oauth2-proxy/oauth2-proxy (Go): affected all versions; no fix listed Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-41059/ (Markdown: https://insights.sbomify.com/CVE-2026-41059/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-41059 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41059 - OSV: https://osv.dev/vulnerability/CVE-2026-41059 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-41059/ Summaries are generated and may contain mistakes; the official description above is the record.