Go/github.com/oauth2-proxy/oauth2-proxy/v7 CVE-2026-41059: high 8.2, EPSS 0.27%

OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex

Action: Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.15.2 or later.

go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2

Affected

Fixed versions

Sources

• osv: GHSA-pxq7-h93f-9jrg
• https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg
• https://nvd.nist.gov/vuln/detail/CVE-2026-41059
• https://github.com/oauth2-proxy/oauth2-proxy

CVE-2026-41059 · published 2026-04-15T19:24:13Z · modified 2026-06-25T23:11:28.958923022Z · JSON