CVE-2026-40574

A flaw was found in OAuth2 Proxy, a reverse proxy providing authentication using OAuth2 providers. A remote attacker can exploit an authorization bypass vulnerability by crafting a malicious email claim. This allows the attacker to bypass `email_domain` restrictions, which are used to limit access to specific email domains, and gain unauthorized access. This issue specifically impacts deployments that rely on `email_domain` restrictions and accept email claims without strict email syntax enforcement.