CVE-2026-76835 describes a critical authentication bypass vulnerability in OAuth2 Proxy affecting its default reverse-proxy configuration. The flaw exists because the proxy trusts client-supplied X-Forwarded-Uri headers when evaluating skip-auth rules, while the guard introduced for CVE-2026-40575 is ineffective in this default setup. The root cause is that buildTrustedProxyNetSet defaults to 0.0.0.0/0 and ::/0 when trusted_proxy_ip is not explicitly configured, effectively trusting every client as a proxy. An unauthenticated attacker can set X-Forwarded-Uri to a value matching an allow-listed route, causing the skip-auth decision to be made against the spoofed path while the actual protected upstream path is forwarded unchanged. This allows complete bypass of authentication controls without any credentials. The vulnerability impacts installations running in reverse-proxy mode without explicit trusted_proxy_ip configuration, which is the default state. Affected code spans pkg/requests/util/util.go, oauthproxy.go, and pkg/apis/middleware/scope.go.
