Critical Authentication Bypass Vulnerability Found in OAuth2 Proxy, No Patch Released
A serious authentication bypass vulnerability has been disclosed in the popular authentication proxy OAuth2 Proxy. The flaw, identified as CVE-2026-76835, can be exploited when the proxy operates in reverse proxy mode without the trusted_proxy_ip configuration enabled.
Attackers can abuse a crafted X-Forwarded-Uri header to bypass authentication checks entirely. This allows unauthenticated access to paths that should be protected, even under default configuration settings.
The root cause lies in the proxy’s trust of forwarded headers sent by clients in reverse proxy environments. Security researchers note that this behavior enables direct access to restricted resources without valid credentials.
While version 7.15.2 introduced a fix for a related issue tracked as CVE-2026-40575, the vulnerability remains present in default reverse proxy deployments. The project repository shows active development toward a fix, yet no patched release has been published.
VulnCheck assigned the flaw a CVSS v4.0 base score of 9.3, rating it Critical. Organizations using OAuth2 Proxy in reverse proxy mode are strongly advised to implement compensating controls until an official update becomes available.
Related articles
Dirty COW CVE-2016-5195: How a 2016 Linux Kernel Race Condition Still Enables Privilege Escalation in Embedded Systems
The 2016 Linux kernel vulnerability CVE-2016-5195, known as Dirty COW, allowed local users to bypass copy-on-write protections and modify read-only memory mappings through a race condition involving writes to /proc/self/mem and madvise calls. Although patched in supported distributions years ago, the flaw persists in older kernels running on routers, cameras, and industrial controllers that receive infrequent firmware updates. Public exploits often target /etc/passwd or SUID binaries for root access, but success depends heavily on the presence of login mechanisms, BusyBox applets, and suitable binaries in the target environment. When standard targets are absent, attackers may pivot to overwriting vDSO functions in process memory to inject code executed by higher-privileged processes. The article explains why ready-made PoCs frequently fail on minimal BusyBox-based systems and outlines the checks required for architecture, ABI, vDSO symbols, and payload compatibility. It also references the practical exercise Strange And Dirty on the free White Hacker course for hands-on adaptation of the exploit chain.
Starting in Bug Bounty: Understanding 1-Day Vulnerabilities
Mikhail Klyuchnikov, known in the bug hunting community as n1, shares his decade-long experience at Positive Technologies leading a team focused on software security analysis. The team specializes in discovering new zero-day vulnerabilities while also reproducing known 1-day issues to support penetration testing engagements. Klyuchnikov is also a member of the PT SWARM team, which regularly publishes technical articles, tips, and timely vulnerability breakdowns. With extensive participation in international bug bounty platforms and the Russian Standoff Bug Bounty program, he aims to explain the practical role of 1-day vulnerabilities for newcomers entering bug bounty hunting. The article provides foundational knowledge on how security researchers leverage publicly disclosed vulnerabilities in real-world testing scenarios.
Keycloak Fixes Critical CVE-2026-18963 Password Reset Flaw Allowing Unauthenticated Account Takeover
Keycloak has patched a critical vulnerability tracked as CVE-2026-18963 that lets remote unauthenticated attackers force a password reset for any user and seize control of the account. The flaw affects the reset-credentials flow due to improper state validation, enabling attackers to bypass email verification and reach the password change endpoint directly. With a CVSS 3.1 score of 9.1, the issue requires no privileges or user interaction and impacts confidentiality and integrity. Patches are available in Keycloak 26.7.2 and corresponding Red Hat Build of Keycloak releases 26.4.15 and 26.6.6. Organizations unable to update immediately should disable the Forgot password feature across all realms. Post-remediation auditing of login events and credential changes on privileged accounts is recommended to detect any prior exploitation attempts.
Sky Discloses Five Vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
Sky has released a security advisory detailing five vulnerabilities affecting its IT asset management tools SKYSEA Client View and SKYMEC IT Manager. The flaws impact all Windows-based components including master servers, management machines, terminal machines, and standalone terminals. Two issues received CVSSv4 base scores of 8.5 while the remaining three scored 5.8, with CVSSv3 scores reversing the severity ranking for some entries. The vulnerabilities include missing authorization checks, improper file permissions during installation, multiple path traversal flaws, and a stack-based buffer overflow. Sky has made update and patch modules available to contracted customers and strongly recommends immediate deployment.