CVE-2025-54576

Workarounds

Immediate mitigations:

1. Review regex patterns: Audit all skip_auth_routes configurations for overly permissive patterns
2. Use precise patterns: Replace wildcard patterns with exact path matches where possible
3. Anchor patterns: Ensure regex patterns are properly anchored (start with ^ and end with $)
4. Path-only matching: Consider implementing custom validation that strips query parameters before regex matching

Example secure configuration:

# Instead of: "^/public/.*"
# Use specific paths: "^/public/assets$", "^/public/health$"
skip_auth_routes = ["^/public/assets$", "^/public/health$", "^/api/status$"]

This vulnerability affects oauth2-proxy deployments using the skip_auth_routes configuration option with regex patterns. The vulnerability allows attackers to bypass authentication by crafting URLs with query parameters that satisfy the configured regex patterns, potentially gaining unauthorized access to protected resources.

The issue stems from skip_auth_routes matching against the full request URI (path + query parameters) instead of just the path as documented. This discrepancy enables authentication bypass attacks where attackers append malicious query parameters to access protected endpoints.

Example Attack:

• Configuration: skip_auth_routes = [ "^/foo/.*/bar$" ]
• Intended behavior: Allow /foo/something/bar
• Actual vulnerability: Also allows /foo/critical_endpoint?param=/bar

Deployments using skip_auth_routes with regex patterns containing wildcards or broad matching patterns are most at risk, especially when backend services ignore unknown query parameters.

CVE-2025-54576 has a CVSS score of 9.1 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.11.0); upgrading removes the vulnerable code path.

Kodem intelligence

A patch has been released with version v7.11.0.

1. What is CVE-2025-54576? CVE-2025-54576 is a critical-severity security vulnerability in github.com/oauth2-proxy/oauth2-proxy/v7 (go), affecting versions <= 7.10.0. It is fixed in 7.11.0.
2. How severe is CVE-2025-54576? CVE-2025-54576 has a CVSS score of 9.1 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/oauth2-proxy/oauth2-proxy/v7 are affected by CVE-2025-54576? github.com/oauth2-proxy/oauth2-proxy/v7 (go) versions <= 7.10.0 is affected.
4. Is there a fix for CVE-2025-54576? Yes. CVE-2025-54576 is fixed in 7.11.0. Upgrade to this version or later.
5. Is CVE-2025-54576 exploitable, and should I be worried? Whether CVE-2025-54576 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-54576 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-54576? Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.11.0 or later.