The vulnerability in openshift/oauth-proxy arises from insufficient verification of data authenticity on paths configured to bypass authentication via skip-auth-regex. The proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) to upstream applications without removing them, enabling unauthenticated attackers to inject forged identity headers on whitelisted paths. This can lead to limited confidentiality and integrity impacts. The issue is tracked as CVE-2026-49331 with a CVSS v3.1 base score of 6.5. Red Hat's advisory recommends reviewing and minimizing skip-auth-regex configurations and adding middleware in upstream applications to ignore these headers on unauthenticated paths. No official fix or patch is currently confirmed.

The vulnerability allows unauthenticated attackers to inject forged identity headers on paths that bypass authentication, potentially leading to limited confidentiality and integrity impacts in the affected applications. There is no impact on availability. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required.

Red Hat advises reviewing and minimizing the use of skip-auth-regex configurations that bypass authentication. Additionally, it is recommended to add middleware in upstream applications to ignore the X-Forwarded-User and related identity headers on unauthenticated paths. No official patch or fix is currently available; patch status is not yet confirmed — check the Red Hat advisory for updates.