Threats tagged 'ghsa-f2m2-cc3f-h4j2'

A vulnerability in openshift/oauth-proxy allows an authenticated low-privilege user to forge an identity header by exploiting the handling of underscore-variant headers. This can override the legitimate authenticated identity in upstream applications. The issue arises because the proxy sets authenticated identity headers using dash-variant keys but does not strip underscore-variant keys, which WSGI and PHP frameworks normalize to the same variable.