OAuth2-Proxy 需授权 中和不当漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.praetorian.com/advisories/oauth2-proxy-header-normalization-bypass/
• https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3
• https://advisories.gitlab.com/golang/github.com/oauth2-proxy/oauth2-proxy/v7/CVE-2026-40574/
• https://ccb.belgium.be/advisories/warning-critical-authentication-bypass-oauth2-can-lead-unauthorized-data-access-patch
• https://www.sentinelone.com/vulnerability-database/cve-2026-41059/
• https://nvd.nist.gov/vuln/detail/CVE-2025-54576
• https://zeropath.com/blog/cve-2025-54576-oauth2-proxy-auth-bypass
• https://nvd.nist.gov/vuln/detail/CVE-2025-54576
• https://avd.aliyun.com/detail?id=AVD-2020-4037

Related Vulnerabilities

• PoCCVE-2026-23693: ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
• PoCCVE-2026-20896: Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass
• PoCCVE-2025-26399: SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE
• LobeChat /webapi/proxy 服务器端请求伪造漏洞（CVE-2026-54157）
• 东胜物流软件 /PriceCarrier/CrmProxyMailListHtmlGridSource.aspx SQL 注入漏洞
• 关于用友GRP-U8Cloud产品getBudgetReleaseProjectList及U8AppProxy及fbpm-modeler存在命令执行漏洞的安全通告
• Apache Druid /proxy/coordinator@ 服务器端请求伪造漏洞（CVE-2025-27888）
• PoClaravel-passport-keys-exposed: Laravel Passport - OAuth2 Keys Exposed
• Gradio /proxy 服务器端请求伪造漏洞（CVE-2023-34239）
• PoCCVE-2025-62168: Squid Proxy - HTTP Authentication Credentials Disclosure
• PoClitellm-unauth-model-exposure: LiteLLM Proxy - Model Exposure
• Artica Proxy /images.listener.php 文件读取漏洞（CVE-2024-2053）
• PoCNginx Proxy Manager /api/tokens 默认口令漏洞