CVE-2025-64484OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation
- 8.5HighCVSS base score
- 0.66%Exploitation in 30 daysEPSS · top 48% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way.
Timeline
ID reserved
By GitHub_M
- 5 days later
· 5 days later
Published
- 4 days later
· 4 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
| NVDNVD · Deferred | 3.1 | High8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.66% · top 48% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.5.
Affected products
- affected < 7.13.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/oauth2-proxy/oauth2-proxy/v7GHSA-vjrc-mh2v-45x6 (opens in a new tab)
References
References5
- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6 (opens in a new tab)x_refsource_CONFIRM
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2 (opens in a new tab)x_refsource_MISC
- https://datatracker.ietf.org/doc/html/rfc822#section-3.2 (opens in a new tab)x_refsource_MISC
- https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html (opens in a new tab)x_refsource_MISC
- https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-50825 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-vjrc-mh2v-45x6 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-64484)Record last updated .