CVE Explorer
CVE-2025-64484
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s f
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"oauth2-proxy","vendor":"oauth2-proxy","versions":[{"status":"affected","version":"< 7.13.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-644","description":"CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"name":"https://datatracker.ietf.org/doc/html/rfc2616#section-4.2","tags":["x_refsource_MISC"],"url":"https://datatracker.ietf.org/doc/html/rfc2616#section-4.2"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/references/1
{"name":"https://datatracker.ietf.org/doc/html/rfc822#section-3.2","tags":["x_refsource_MISC"],"url":"https://datatracker.ietf.org/doc/html/rfc822#section-3.2"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/references/2
{"name":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6","tags":["x_refsource_CONFIRM"],"url":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/references/0
{"name":"https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html","tags":["x_refsource_MISC"],"url":"https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/references/3
{"name":"https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx","tags":["x_refsource_MISC"],"url":"https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:90ce4e0e41bdbd8b06b57dc63f97ef3daf4d09280384253cde625589187c176d · sha256:1c90ca7834f1f0c3… · /containers/cna/references/4
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.