CVE-2025-64484: 
MinimOS vulnerability analysis and mitigation

CVE-2025-64484 is a header smuggling vulnerability in OAuth2-Proxy that allows authenticated users to inject underscore variants of X-Forwarded-* headers, bypassing the proxy's filtering logic and potentially escalating privileges in upstream applications. It affects all OAuth2-Proxy deployments (versions ≤ 7.12.0) placed in front of applications that normalize underscores to dashes in HTTP headers, such as WSGI-based frameworks (Django, Flask, FastAPI) and PHP applications. The vulnerability was published on November 8, 2025, and patched in version 7.13.0. It carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory, OAuth2-Proxy Advisory).

The root cause is classified as CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax). OAuth2-Proxy strips security-sensitive headers like X-Forwarded-For before forwarding requests to upstream services, but its filtering logic does not account for underscore variants (e.g., X_Forwarded_For) or alternative capitalizations. Because many WSGI frameworks (Django, Flask, FastAPI) and PHP applications normalize underscores to dashes when processing HTTP headers, an attacker can send a request with X_Forwarded_For — which OAuth2-Proxy fails to strip — and the upstream application will interpret it as the legitimate X-Forwarded-For header. This allows an authenticated low-privileged user to spoof trusted header values and potentially gain elevated access in the upstream application. A community-published PoC repository was noted at github.com/B1ack4sh/Blackash-CVE-2025-64484 (GitHub Advisory, OAuth2-Proxy Advisory).

Successful exploitation allows an authenticated attacker with low privileges to manipulate X-Forwarded-* headers seen by upstream applications, potentially spoofing IP addresses, user identities, or other trust signals used for authorization decisions. This can lead to privilege escalation within the upstream application, unauthorized access to restricted resources, and manipulation of application behavior — particularly in WSGI-based frameworks that rely on forwarded headers for access control. Confidentiality impact is rated High (sensitive data exposure) and integrity impact is Low; availability is not affected. OAuth2-Proxy's own authentication and authorization mechanisms are not compromised (GitHub Advisory).

No public proof-of-concept exploit has been confirmed as functional, though a PoC repository (github.com/B1ack4sh/Blackash-CVE-2025-64484) appeared shortly after disclosure. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.048% (15th percentile), indicating a currently low probability of exploitation in the near term. Exploitation requires the attacker to already be authenticated, limiting the attack surface (GitHub Advisory, Feedly).

1. Authenticate: Obtain valid credentials or a session token for the OAuth2-Proxy-protected application — exploitation requires at least low-level authenticated access.
2. Identify target framework: Confirm the upstream application uses a WSGI-based framework (Django, Flask, FastAPI) or PHP, which normalizes underscores to dashes in HTTP header names.
3. Craft malicious request: Construct an HTTP request that includes underscore variants of trusted forwarded headers, e.g., X_Forwarded_For: 127.0.0.1 or X_Forwarded_User: admin, instead of the standard dash-separated form.
4. Send request through proxy: Submit the crafted request to the OAuth2-Proxy endpoint. The proxy's header-stripping logic will not recognize the underscore variant and will forward it to the upstream application without stripping it.
5. Upstream normalization: The upstream WSGI/PHP application normalizes X_Forwarded_For to X-Forwarded-For, treating the attacker-supplied value as a legitimate trusted header.
6. Achieve privilege escalation: If the upstream application uses the forwarded header for IP allowlisting, user identity resolution, or role assignment, the attacker gains unauthorized elevated access or bypasses security controls (GitHub Advisory, OAuth2-Proxy Advisory).

• Network: Inbound HTTP requests to OAuth2-Proxy containing headers with underscores in place of dashes for standard forwarded headers (e.g., X_Forwarded_For, X_Forwarded_User, X_Forwarded_Email, X_Real_Ip).
• Logs: OAuth2-Proxy access logs showing authenticated requests with unusual header names containing underscores; upstream application logs showing unexpected IP addresses or user identities in X-Forwarded-* headers that differ from the authenticated session context.
• Application Behavior: Upstream application audit logs recording privilege escalation events or access to restricted resources by users whose OAuth2-Proxy session does not normally grant such access; anomalous role assignments or authorization decisions correlated with forwarded header values.

Upgrade OAuth2-Proxy to version 7.13.0 or later, which introduces header normalization by default — treating headers with underscores and dashes as equivalent so that both X-Forwarded-For and X_Forwarded-for are stripped. For deployments that legitimately need to distinguish between similarly named headers, the new InsecureSkipHeaderNormalization field in the AlphaConfig Header struct can be set to true on a per-header basis (use with caution). As a temporary workaround for those unable to upgrade immediately, configure upstream services (Django, Flask, FastAPI, PHP) to not treat underscores and hyphens as equivalent in header names, or add explicit header filtering at the application layer (GitHub Advisory, OAuth2-Proxy Advisory).

The vulnerability was reported by security researcher 47Cid and published by maintainer tuunit on November 8, 2025. It was featured in a CISA vulnerability bulletin for the week of November 10, 2025, and appeared in community discussions on Reddit's CVEWatch as a top trending CVE. Praetorian published a technical blog post on reverse proxy header attacks that references this class of vulnerability, highlighting broader industry awareness of header smuggling risks in proxy architectures (CISA Bulletin, Praetorian Blog).