Introduction
One misconfigured regex in a widely deployed authentication proxy can leave protected endpoints open to attackers. OAuth2-Proxy, a popular open-source authentication gateway used in Kubernetes and cloud-native environments, recently ran into exactly that problem with CVE-2025-54576. The vulnerability directly affects organizations that rely on OAuth2-Proxy for access control, especially those using the skip_auth_routes configuration to exempt certain endpoints from authentication.
OAuth2-Proxy is an open-source project with significant adoption in cloud and enterprise environments. It is a reverse proxy that provides OAuth 2.0 and OpenID Connect authentication for web applications, and it integrates with major identity providers and orchestration platforms. Its flexibility and community-driven development have made it a go-to choice for secure ingress in microservices architectures.
Technical information
CVE-2025-54576 comes from how OAuth2-Proxy (versions 7.10.0 and below) processes the skip_auth_routes configuration option. The option lets administrators specify regex patterns for paths that should bypass authentication, and those patterns are meant to match against the request path only.
The implementation instead matches the regex against the entire request URI, including query parameters. Take a pattern such as:
skip_auth_routes = [ "^/foo/.*/bar$" ]
It is intended to match only /foo/something/bar, but it also matches requests like /foo/critical_endpoint?param=/bar, because the query parameter param=/bar satisfies the end of the regex. Authentication is then skipped for requests that should have been protected.
The root cause is in the request matching logic, in these files:
Because the vulnerable logic evaluates the regex against the full URI rather than just the path, attackers can craft URLs with query parameters that trigger unintended matches. Deployments with broad or wildcard regex patterns in skip_auth_routes are especially at risk.
Patch information
The OAuth2-Proxy development team has released version 7.11.0, which fixes the issue by changing how skip_auth_routes patterns are matched. Before the fix, the patterns were applied to the full request URI, path and query parameters together. That let attackers craft URLs with query parameters that bypassed authentication.
The patch matches patterns against the request path only and ignores query parameters. skip_auth_routes patterns now behave as intended, and manipulated query strings no longer give unauthorized access.
For example, with the configuration skip_auth_routes = [ "^/foo/.*/bar$" ], the intended behavior is to allow access to paths like /foo/something/bar. After the patch, the pattern no longer matches unintended URLs such as /foo/critical_endpoint?param=/bar.
To apply the fix, upgrade to OAuth2-Proxy version 7.11.0 or later. It is also worth reviewing existing skip_auth_routes configurations to make sure the regex patterns are defined correctly and do not inadvertently allow access to sensitive endpoints.
Reference: GitHub Security Advisory GHSA-7rh7-c77v-6434
Detection methods
Detecting exploitation of CVE-2025-54576 means combining log analysis, network monitoring, and specific detection rules. Detailed detection guidance for this particular CVE is limited, so the strategies below draw on similar vulnerabilities.
Log analysis
- Monitor application logs for unusual entries that may indicate exploitation attempts, such as error messages or stack traces that deviate from normal application behavior.
- Examine system logs for signs of unauthorized access or privilege escalation.
Network monitoring
- Watch network traffic for unusual patterns, such as unexpected outbound connections or data exfiltration attempts.
- Watch for connections to known malicious IPs or domains, which could indicate command and control (C2) communications.
Detection rules
- Write YARA rules to identify malicious payloads or scripts associated with the exploitation of similar vulnerabilities.
- Implement Sigma rules to detect log patterns that may indicate exploitation attempts.
Monitoring guidance
- Deploy endpoint detection and response (EDR) tools to monitor for suspicious processes or behavior on endpoints.
- Use intrusion detection systems (IDS) to detect and alert on network-based indicators of compromise.
Affected systems and versions
- Product: OAuth2-Proxy
- Affected versions: 7.10.0 and below
- Vulnerable configuration: Deployments using
skip_auth_routeswith regex patterns, especially those containing wildcards or broad matching expressions
Vendor security history
OAuth2-Proxy has fixed earlier security issues, including:
- CVE-2021-21291: Open redirect in whitelist domain feature (prior to 7.0.0)
- CVE-2020-5233: Open redirect via crafted redirect URLs (prior to 5.0)
The project patches quickly and has a mature process for handling security advisories through GitHub. Community engagement and regular updates also contribute to its overall security posture.
