CVE-2025-54576OAuth2-Proxy skip_auth_routes regex matches the full URI
What broke
OAuth2-Proxy compared skip_auth_routes regular expressions to the full request URI, query string included. An attacker who could add a query parameter that matched a skip rule reached a protected path without a session. CVSS 9.1. Patched in the upstream project.
Why it matters
OAuth2-Proxy is the default identity sidecar in a lot of Kubernetes and internal-tool deployments. A skip-list bypass is a full authentication bypass for every app behind that proxy. The failure mode is classic: a convenience regex, a forgotten query string, a production allow-list that was meant for /metrics and accidentally matched ?foo=/metrics.
What to do
- Upgrade OAuth2-Proxy and re-read every
skip_auth_routesentry. Match on path only. - Prefer an explicit allow-list of path prefixes over a regex.
- Confirm
/metrics,/health, and callback URLs cannot be smuggled as query values on admin routes.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- TechniqueAttacker-in-the-middle phishing proxy
A reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful lo