Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2025-54576OAuth2-Proxy skip_auth_routes regex matches the full URI

critical · CVSS 9.1
Product: OAuth2-ProxyVendor: OAuth2-ProxyDisclosed: 2025-07-28Status: PatchedProtocol deep diveNVD ↗

What broke

OAuth2-Proxy compared skip_auth_routes regular expressions to the full request URI, query string included. An attacker who could add a query parameter that matched a skip rule reached a protected path without a session. CVSS 9.1. Patched in the upstream project.

Why it matters

OAuth2-Proxy is the default identity sidecar in a lot of Kubernetes and internal-tool deployments. A skip-list bypass is a full authentication bypass for every app behind that proxy. The failure mode is classic: a convenience regex, a forgotten query string, a production allow-list that was meant for /metrics and accidentally matched ?foo=/metrics.

What to do

  • Upgrade OAuth2-Proxy and re-read every skip_auth_routes entry. Match on path only.
  • Prefer an explicit allow-list of path prefixes over a regex.
  • Confirm /metrics, /health, and callback URLs cannot be smuggled as query values on admin routes.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.