Loading story…
Two high-severity vulnerabilities in OAuth2 Proxy can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. CVE-2026-34457 affects versions prior to 7.15.2 when OAuth2 Proxy is used with auth_request-style integrations such as nginx auth_request and either --ping-user-agent or --gcp-healthchecks is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as CWE-290 and carries a CVSS 3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
A second flaw, CVE-2026-40575, affects OAuth2 Proxy versions 7.5.0 through 7.15.1 when --reverse-proxy is enabled alongside --skip-auth-regex or --skip-auth-route. In those setups, the product may trust a client-supplied X-Forwarded-Uri header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in OAuth2 Proxy 7.15.2. Recommended mitigations include upgrading immediately, stripping or overwriting X-Forwarded-Uri, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
OAuth2 Proxy version 7.15.2 fixed CVE-2026-41059, a configuration-dependent authentication bypass affecting versions 7.5.0 through 7.15.1 when skip_auth_routes or legacy skip_auth_regex used overly broad patterns. Attackers could craft paths containing # or %23 so public allowlist checks matched while backend applications served protected content.
OAuth2 Proxy version 7.15.2 also patched CVE-2026-40575, which could let unauthenticated remote attackers bypass authentication in specific reverse-proxy configurations. Recommended mitigations included stripping or overwriting X-Forwarded-Uri, restricting direct access to OAuth2 Proxy, and tightening skip-auth rules.
GitHub Security Advisories received CVE-2026-40575 on April 22, 2026, describing an authentication bypass in OAuth2 Proxy versions 7.5.0 through 7.15.1 when reverse-proxy mode and skip-auth rules are enabled. The flaw allows attackers to spoof the X-Forwarded-Uri header so authentication is evaluated against a different path than the one forwarded upstream.
OAuth2 Proxy released version 7.15.2 to fix CVE-2026-34457, a configuration-dependent authentication bypass affecting auth_request-style deployments that enabled ping-user-agent or GCP health checks. In vulnerable setups, attackers could send the configured health-check User-Agent to access protected upstream resources without authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ORY disclosed two high-severity vulnerabilities in **Oathkeeper** that can let attackers bypass access controls in deployments running versions prior to `26.2.0`. `CVE-2026-33496` is an authentication bypass in the `oauth2_introspection` authenticator caused by cache key confusion: cached token validation results do not distinguish between different introspection server URLs. In affected environments, an attacker with a valid token for one configured introspection server may be able to have that result reused against another server if caching is enabled and multiple introspection backends accept different tokens. ORY also fixed `CVE-2026-33494`, an authorization bypass caused by HTTP path traversal when Oathkeeper evaluates raw, unnormalized request paths against access rules. An attacker can craft requests such as: ```text /public/../admin/secrets ``` so the request matches a permissive rule before normalization but reaches a protected resource afterward. Both issues were addressed in **Oathkeeper `26.2.0`**, with ORY recommending upgrades; for `CVE-2026-33496`, disabling caching for `oauth2_introspection` authenticators is listed as a workaround where immediate patching is not possible.
Jun 29, 2026
A critical vulnerability in ProxySQL, tracked as **CVE-2026-48772**, allows remote attackers to spoof client source IP addresses by abusing improper parsing of HAProxy PROXY protocol v1 `UNKNOWN` headers. A crafted frame with appended address fields can cause ProxySQL to trust a forged IP and use it in `mysql_query_rules.client_addr`, `stats_mysql_processlist.cli_host`, and `event_log`, enabling access-control and routing bypass as well as misleading audit trails. The issue affects ProxySQL versions **2.0.0 through 3.0.8** and is especially dangerous because `mysql-proxy_protocol_networks = '*'` is the default, exposing any reachable MySQL frontend to attempted exploitation. The flaw was reproduced in testing by sending a forged address that triggered query rules intended for a different client, demonstrating the ability to influence schema pinning, query filtering, and other IP-based controls. ProxySQL addressed the issue in **version 3.0.9**, which also fixed another critical pre-authentication memory-corruption bug, **CVE-2026-48773**. Security advisories rate CVE-2026-48772 as remotely exploitable and severe, with published scores ranging from **CVSS 9.1 to 10.0**, and urge organizations running **3.0.8 or earlier** to upgrade immediately.
Jun 29, 2026
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026