GO-2025-4113
NoneCVSS
—
EPSS
—
Published
Nov 17, 2025
CISA due date
—
The record
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/oauth2-proxy/oauth2-proxy | 0 | No fix |
| Go | github.com/oauth2-proxy/oauth2-proxy/v7 | 0 | 7.13.0 |
| Bitnami | oauth2-proxy | 0 | 7.13.0 |