OAuth2-Proxy up to 7.12.x HTTP Header http headers for scripting syntax

Summaryinfo

A vulnerability has been found in OAuth2-Proxy up to 7.12.x and classified as critical. This issue affects some unknown processing of the component HTTP Header Handler. The manipulation leads to improper neutralization of http headers for scripting syntax. This vulnerability is referenced as CVE-2025-64484. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OAuth2-Proxy up to 7.12.x. It has been rated as critical. This issue affects an unknown part of the component HTTP Header Handler. The manipulation with an unknown input leads to a improper neutralization of http headers for scripting syntax vulnerability. Using CWE to declare the problem leads to CWE-644. The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-64484 since 11/05/2025. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 7.13.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Name

• OAuth2-Proxy

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12

Website

• Product: https://github.com/oauth2-proxy/oauth2-proxy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion