OAuth2-Proxy Vulnerability Enables Authentication Bypass by Manipulating Query Parameters
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A critical security vulnerability has been identified in OAuth2-Proxy, a widely-used reverse proxy<\/a> that provides authentication services for Google, Azure, OpenID Connect, and numerous other identity providers.\u00a0<\/p>\n The vulnerability, designated as CVE-2025-54576, enables attackers to bypass authentication mechanisms by manipulating query parameters in crafted URLs, potentially granting unauthorized access to protected resources.<\/p>\n The vulnerability specifically affects OAuth2-Proxy deployments utilizing the skip_auth_routes configuration option with regex patterns.\u00a0<\/p>\n The security flaw stems from the system\u2019s incorrect handling of request URI matching, where the authentication<\/a> bypass occurs because skip_auth_routes matches against the complete request URI (including both path and query parameters) rather than just the path component as documented.<\/p>\n This discrepancy creates a significant attack vector where malicious actors can append specially crafted query parameters to URLs, effectively satisfying configured regex patterns and circumventing authentication controls.\u00a0<\/p>\n For example, a configuration setting skip_auth_routes = [ \u201c^\/foo\/.*\/bar$\u201d ] intended to allow access only to \/foo\/something\/bar can be exploited to also permit access to \/foo\/critical_endpoint?param=\/bar.\u00a0<\/p>\n The vulnerability code is present in oauthproxy.go#L582-584 and pkg\/requests\/util\/util.go#L37-L44, where the improper URI handling logic resides.<\/p>\n This vulnerability is rated as Critical with a CVSS v3.1 score reflecting high confidentiality and integrity impact (CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N).\u00a0<\/p>\n Deployments most at risk include those using skip_auth_routes with regex patterns containing wildcards or broad matching patterns, particularly when backend services ignore unknown query parameters.<\/p>\nKey Takeaways<\/mark><\/strong>
1. OAuth2-Proxy <7.10.0 has a critical authentication bypass.
2. System matches full URI instead of path-only, allowing malicious URLs to bypass security.
3. Upgrade to v7.11.0 and use specific regex patterns instead of wildcards.<\/pre>\nOAuth2-Proxy Vulnerability<\/strong><\/h2>\n