CVE-2025-64484
Description
A header-smuggling vulnerability was found in OAuth2-Proxy’s handling of HTTP headers containing underscores (_) (such as X_Forwarded_For). The proxy failed to properly normalize these header names, which could allow crafted requests to bypass header validation or filtering. When OAuth2-Proxy is deployed in front of applications (e.g., WSGI frameworks like Django, Flask, FastAPI, or PHP apps) that treat underscores and hyphens differently in header names, an authenticated attacker could exploit this to inject or manipulate upstream headers, potentially gaining unauthorized access to protected endpoints or sensitive information. The vulnerability affects deployments where header trust boundaries are not strictly enforced between the proxy and the backend application.
Statement
This flaw has been rated High severity (CVSS 8.5) by Red Hat Product Security.
S:C (Changed): As the vulnerability within OAuth2-Proxy can affect the behavior of an upstream application that relies on the proxy for identity and access control. The vulnerability causes the proxy to cause a behavior in the backend (internal component) that changes the effective security boundary (the backend treats the injected header as trusted), so scope is changed.
C:H (High): An attacker can gain access to protected internal endpoints / sensitive application data by bypassing proxy controls.
I:L (Low): The attacker may be able to influence request routing or authentication headers (some integrity impact), rather than alter application data. Full integrity compromise is unlikely from just header name normalization.
A:N (None): Availability is not impacted.
It is important to note that this vulnerability only applies when OAuth2-Proxy is deployed in front of an application that normalizes or treats underscore header names differently from hyphens, not all deployments are exposed
The authentication/authorization logic of OAuth2-Proxy itself is not compromised.
Mitigation
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
Run arbitrary code.
Confidentiality
Technical Impact: Read Application Data
Attackers may be able to obtain sensitive information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
