CVE-2026-41059: 
Homebrew vulnerability analysis and mitigation

CVE-2026-41059 is an authentication bypass vulnerability in OAuth2 Proxy, a reverse proxy providing authentication via OAuth2 providers. Affecting versions 7.5.0 through 7.15.1, the flaw allows unauthenticated attackers to bypass authentication controls under specific configuration conditions involving skip_auth_routes or skip_auth_regex with broad wildcard patterns. It was published on April 22, 2026, with a patch released in version 7.15.2. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). OAuth2 Proxy fails to normalize request paths before evaluating them against skip_auth_routes or skip_auth_regex allowlist rules, allowing the # character (or its URL-encoded form %23) in a crafted path to manipulate how the proxy matches the request against public allowlist patterns. For example, a pattern like ^/foo/.*/bar$ could be satisfied by a path such as /foo/secret#/bar, causing the proxy to treat the request as public while the backend application — which interprets # as a fragment delimiter — routes the request to the protected /foo/secret resource. Exploitation requires no authentication, no user interaction, and is network-accessible (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to access protected upstream resources without valid credentials, resulting in high confidentiality impact and low integrity impact with no availability impact. Sensitive application data and endpoints that should be gated behind OAuth2 authentication can be exposed directly. The scope of impact is limited to deployments meeting all three prerequisite conditions (use of skip-auth options, broad wildcard patterns, and a backend that interprets # as a fragment delimiter), but within those deployments the exposure can be significant (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability has an EPSS score of approximately 0.204%, indicating a low probability of exploitation in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by specific configuration prerequisites, limiting the attack surface to a subset of OAuth2 Proxy deployments (GitHub Advisory).

1. Reconnaissance: Identify deployments of OAuth2 Proxy versions 7.5.0–7.15.1 that use skip_auth_routes or skip_auth_regex with broad wildcard patterns (e.g., ^/foo/.*/bar$).
2. Identify target paths: Enumerate or infer protected resource paths on the upstream application (e.g., /foo/secret) that would normally require authentication.
3. Craft malicious request: Construct an HTTP request with a path that satisfies the skip-auth allowlist regex while embedding a # or %23 fragment to redirect the backend to the protected resource. For example: GET /foo/secret%23/bar HTTP/1.1.
4. Send unauthenticated request: Submit the crafted request directly to the OAuth2 Proxy endpoint without any authentication headers or tokens.
5. Access protected resource: The proxy matches the path against the public allowlist rule and forwards the request unauthenticated; the backend interprets the fragment and serves the protected resource at /foo/secret (GitHub Advisory).

• Network: Unauthenticated HTTP requests to OAuth2 Proxy endpoints containing %23 or literal # in the URL path, particularly targeting paths that match configured skip_auth_routes or skip_auth_regex patterns.
• Logs: OAuth2 Proxy access logs showing requests to skip-auth-matched paths from unauthenticated clients (no session cookie or Bearer token) that result in successful upstream responses (HTTP 200) to normally protected resources.
• Logs: Upstream application logs showing requests to protected paths originating from the OAuth2 Proxy without corresponding authentication context, especially paths containing fragment-like suffixes.
• Network: Repeated probing of multiple path variations with %23 or # characters from a single source IP, indicative of automated scanning or enumeration (GitHub Advisory).

The primary remediation is to upgrade OAuth2 Proxy to version 7.15.2 or later, which normalizes request paths more conservatively before skip-auth matching so that fragment content cannot influence allowlist decisions. For deployments that cannot upgrade immediately, the following workarounds are recommended:

• Replace broad wildcard skip_auth_routes and skip_auth_regex rules with exact, anchored public paths and explicit HTTP method constraints.
• Reject requests whose path contains %23 or # at the ingress, load balancer, or WAF level before they reach OAuth2 Proxy.
• Avoid placing sensitive application paths behind broad skip-auth rules.

Deployments that do not use skip_auth_routes or skip_auth_regex are not affected and require no action (GitHub Advisory).

The vulnerability was reported by security researcher rootxharsh and disclosed via the GitHub Security Advisory program. Social media coverage was observed on Mastodon (via @thehackerwire) and on CVE tracking platforms shortly after publication. Community reaction has been measured, consistent with the configuration-dependent nature of the flaw and the absence of active exploitation or public PoC code (GitHub Advisory).