CVE-2026-34457

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health check regardless of the requested path, allowing an unauthenticated remote attacker to bypass authentication and access protected upstream resources. Deployments that do not use auth_request-style subrequests or that do not enable --ping-user-agent/--gcp-healthchecks are not affected. This issue is fixed in 7.15.2.

• CWE-290

• https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.2Release Notes
• https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6vMitigation, Vendor Advisory

Published

Apr 14, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34451Claude SDK for TypeScript provides access to the Claude API …5.4
• CVE-2026-34452The Claude SDK for Python provides access to the Claude API …5.3
• CVE-2026-34453SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-34454OAuth2 Proxy is a reverse proxy that provides authentication…3.5
• CVE-2026-34455Hi.Events is an open-source event management and ticket sell…8.8
• CVE-2026-34456Reviactyl is an open-source game server management panel bui…9.8
• CVE-2026-34458Sandboxie-Plus is an open source sandbox-based isolation sof…8.8
• CVE-2026-34459Sandboxie-Plus is an open source sandbox-based isolation sof…8.8
• CVE-2026-3446When calling base64.b64decode() or related functions the dec…6
• CVE-2026-34460NamelessMC is website software for Minecraft servers. In ver…5.4
• CVE-2026-34461Sandboxie-Plus is an open source sandbox-based isolation sof…7.8
• CVE-2026-34462Sandboxie-Plus is an open source sandbox-based isolation sof…7.8