v7.15.2

Anjok07/ultimatevocalremoverguiv7.15.2Apr 14, 2026by github-actions[bot]

AI Summary

A major security update that addresses multiple critical vulnerabilities including authentication bypasses and session fixation attacks while upgrading Golang and introducing a new proxy trust flag.

Key Highlights

Fixed multiple critical security vulnerabilities (authentication bypasses and session fixation).
Upgraded Golang to v1.25.9 and updated dependencies.
Introduced new `--trusted-proxy-ip` flag to prevent header spoofing attacks.

New Features

Security hardening against critical vulnerabilities.
Golang version upgrade.
New `--trusted-proxy-ip` flag for enhanced header trust management.

Full Release Notes

## Release Highlights

- 🔵 Golang version upgrade to v1.25.9
    - Upgrade of all dependencies to their latest versions
    - [CVE-2026-34986](https://nvd.nist.gov/vuln/detail/CVE-2026-34986)
    - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281)
    - [CVE-2026-32289](https://nvd.nist.gov/vuln/detail/CVE-2026-32289)
    - [CVE-2026-32288](https://nvd.nist.gov/vuln/detail/CVE-2026-32288)
    - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280)
    - [CVE-2026-32282](https://nvd.nist.gov/vuln/detail/CVE-2026-32282)
    - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283)
-  🕵️‍♀️ Vulnerabilities have been addressed

## Important Notes

We have had security audits performed on OAuth2 Proxy in the past couple of weeks and as a result we have fixed
several CRITICAL vulnerabilities.

The security vulnerabilities include multiple authentication bypasses and a potential session fixation attack.
For more details and to identify if you are effects, we urge all users of OAuth2 Proxy to read the security 
disclosures.

- (Critical) [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass 
- (Critical) [GHSA-7x63-xv5r-3p2x](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x) fix: authentication bypass via X-Forwarded-Uri header spoofing
- (High) [GHSA-pxq7-h93f-9jrg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg) fix: fragment evaluation as part of the allowed routes
- (Moderate) [GHSA-c5c4-8r6x-56w3](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3) fix: email validation bypass via malformed multi-@ email claims

Furthermore, for improving the security of OAuth2 Proxy we introduced a new flag `--trusted-proxy-ip` that allows users
to explicitly specify trusted reverse proxy IPs for the `X-Forwarded-*` headers. This is an important step to prevent 
potential header spoofing attacks and to ensure that OAuth2 Proxy only trusts headers from known and trusted sources.
We highly recommend users to review their deployment architecture and consider using this flag to enhance the security 
of their OAuth2 Proxy instances. Check the docs for more details: https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#proxy-options

Furthermore, we want to thank everyone who contributed to the audits and reported potential issues to make open source 
software like OAuth2 Proxy more secure for everyone. 

## Breaking Changes

## Changes since v7.15.1

- [#3411](https://github.com/oauth2-proxy/oauth2-proxy/pull/3411) chore(deps): update gomod dependencies (@tuunit)
- [#3333](https://github.com/oauth2-proxy/oauth2-proxy/pull/3333) fix: invalidate session on fatal OAuth2 refresh errors (@frhack)
- [GHSA-f24x-5g9q-753f](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f) fix: clear session cookie at beginning of signinpage handler (@fnoehWM / @bella-WI / @tuunit)
- [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass (@tuunit)
- [GHSA-7x63-xv5r-3p2x](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x) fix: authentication bypass via X-Forwarded-Uri header spoofing (@tuunit)
- [GHSA-pxq7-h93f-9jrg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg) fix: fragment evaluation as part of the allowed routes (@tuunit)
- [GHSA-c5c4-8r6x-56w3](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3) fix: email validation bypass via malformed multi-@ email claims (@tuunit)