CVE-2026-40574
Description
A flaw was found in OAuth2 Proxy, a reverse proxy providing authentication using OAuth2 providers. A remote attacker can exploit an authorization bypass vulnerability by crafting a malicious email claim. This allows the attacker to bypass email_domain restrictions, which are used to limit access to specific email domains, and gain unauthorized access. This issue specifically impacts deployments that rely on email_domain restrictions and accept email claims without strict email syntax enforcement.
Statement
A Moderate impact authorization bypass flaw exists in OAuth2 Proxy affecting deployments configured with email_domain restrictions. This vulnerability allows a remote attacker to bypass these restrictions by crafting a malicious email claim, such as attacker@evil.com@company.com, if the identity provider or claim mapping does not strictly enforce standard email syntax. Red Hat deployments are only affected if they rely on email_domain restrictions and accept email claims without strict validation.
Mitigation
To mitigate this issue, configure identity providers or claim mappings to strictly enforce normal email syntax for all email claim values. This prevents the acceptance of malformed email claims that could bypass `email_domain` restrictions. Red Hat recommends reviewing OAuth2 Proxy deployment configurations and associated identity providers to ensure robust email validation is in place.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
