CyberRota Analysis
AI-GeneratedThe vulnerability exists in the openshift/oauth-proxy, where it improperly handles authenticated identity headers by failing to strip underscore-variant keys from incoming requests. This flaw allows low-privilege users to potentially forge their identity, overriding legitimate authenticated identities in upstream applications. Organizations utilizing this proxy should prioritize addressing this issue to mitigate risks of unauthorized access and identity spoofing.
Original NVD Description
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.