CVE-2025-54576OAuth2-Proxy skip_auth_routes regex matches the full URI

What broke

OAuth2-Proxy compared skip_auth_routes regular expressions to the full request URI, query string included. An attacker who could add a query parameter that matched a skip rule reached a protected path without a session. CVSS 9.1. Patched in the upstream project.

Why it matters

OAuth2-Proxy is the default identity sidecar in a lot of Kubernetes and internal-tool deployments. A skip-list bypass is a full authentication bypass for every app behind that proxy. The failure mode is classic: a convenience regex, a forgotten query string, a production allow-list that was meant for /metrics and accidentally matched ?foo=/metrics.

What to do

• Upgrade OAuth2-Proxy and re-read every skip_auth_routes entry. Match on path only.
• Prefer an explicit allow-list of path prefixes over a regex.
• Confirm /metrics, /health, and callback URLs cannot be smuggled as query values on admin routes.

After you patch

Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.

• Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
• Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
• Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
• Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of alg: none. See JWT and the validate a JWT recipe.

Sources

• NVD: CVE-2025-54576