User Impersonation Affecting github.com/oauth2-proxy/oauth2-proxy/v7/pkg/middleware package, versions <7.15.2

Affected versions of this package are vulnerable to User Impersonation via the isHealthCheckRequest function in pkg/middleware/healthcheck.go. An attacker can reach protected endpoints by sending a request with a configured health-check User-Agent, causing the middleware to treat the request as a health check and skip normal authentication. This allows unauthenticated access to routes, such as the auth request endpoint, when a matching health-check user agent is accepted.

Notes

• The bypass is configuration-gated: it's only applicable in auth_request-style deployments that also enable --ping-user-agent or --gcp-healthchecks; setups that rely on other request flows or leave those health-check options unset are not in scope.

Workarounds

• Disable --gcp-healthchecks if you do not need Google Cloud health checks; this prevents requests with the GoogleHC/1.0 user agent from being treated as health checks.
• Remove any configured --ping-user-agent; this prevents client requests that match that user agent from bypassing normal authentication handling.
• Configure your reverse proxy so it does not forward client-controlled User-Agent headers to the OAuth2 Proxy auth subrequest; this prevents an attacker from supplying a matching health-check user agent to the protected auth endpoint.

• GitHub Commit
• Maintainer's Advisory