Threats tagged 'ghsa-vjrc-mh2v-45x6'

OAuth2 Proxy versions prior to 7.13.0 are vulnerable to a header smuggling issue where authenticated users can bypass header filtering by using underscore variants of X-Forwarded-* headers. This can lead to potential privilege escalation in upstream applications that normalize underscores to dashes in HTTP headers, such as those using WSGI-based frameworks. The vulnerability does not compromise OAuth2 Proxy's authentication or authorization mechanisms. The issue is fixed in version 7.13.0 by normalizing header names to treat underscores and dashes equivalently when stripping headers.