CVE-2025-64484
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-11-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oauth2-proxy | oauth2-proxy | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-644 | The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects OAuth2-Proxy versions prior to 7.13.0 when deployed in front of applications that normalize underscores to dashes in HTTP headers. Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy's filtering logic, potentially allowing privilege escalation in the upstream application. The OAuth2 Proxy's own authentication and authorization are not compromised. The issue was fixed in version 7.13.0 by normalizing headers to treat underscores and dashes equivalently when filtering.
How can this vulnerability impact me? :
This vulnerability can allow authenticated users to bypass header filtering in OAuth2-Proxy and escalate their privileges in the upstream application. This could lead to unauthorized access or actions within the protected application, potentially compromising sensitive data or functionality.
What immediate steps should I take to mitigate this vulnerability?
Upgrade OAuth2 Proxy to version 7.13.0 or later, where the vulnerability is patched by normalizing headers to treat underscores and dashes equivalently. As a workaround, ensure that filtering and processing logic in upstream services do not treat underscores and hyphens in HTTP headers the same way to prevent bypassing the proxy's filtering logic.