Security Digest: April 15, 2026 - 4 Critical Vulnerabilities

Today, we highlight four critical vulnerabilities that demand immediate attention from development and security teams.

· 3 min read

Urgent Security Alert: Critical Vulnerabilities Discovered

Today, we highlight four critical vulnerabilities that demand immediate attention from development and security teams. These vulnerabilities impact OAuth2 Proxy, Thymeleaf, and Jetty, with potential risks including authentication bypass, server-side template injection, and HTTP request smuggling.

Critical Vulnerabilities

CVE-2026-40575: OAuth2 Proxy Authentication Bypass

  • Impact: Attackers can bypass authentication, gaining unauthorized access to protected routes.
  • Affected Systems: OAuth2 Proxy configured with --reverse-proxy and --skip-auth-route or --skip-auth-regex.
  • Immediate Action: Upgrade to version v7.15.2 and configure --trusted-proxy-ip to restrict trusted IPs.
  • Mitigation: Strip and overwrite X-Forwarded-Uri headers at the reverse proxy level.

CVE-2026-40478: Thymeleaf Expression Injection Vulnerability

  • Impact: Allows server-side template injection via unvalidated user input.
  • Affected Systems: Thymeleaf up to and including 3.1.3.RELEASE.
  • Immediate Action: Upgrade to Thymeleaf 3.1.4.RELEASE immediately.
  • Mitigation: Ensure no unvalidated user input is passed to the template engine.

CVE-2026-40477: Thymeleaf Unauthorized Expression Execution

  • Impact: Unauthorized access to sensitive objects via server-side template injection.
  • Affected Systems: Thymeleaf up to and including 3.1.3.RELEASE.
  • Immediate Action: Upgrade to Thymeleaf 3.1.4.RELEASE without delay.
  • Mitigation: Avoid passing unvalidated user input directly to the template engine.

CVE-2026-2332: Jetty HTTP Request Smuggling

  • Impact: Enables request smuggling, cache poisoning, and potential session hijacking.
  • Affected Systems: Jetty HTTP/1.1 with chunked transfer encoding.
  • Immediate Action: Monitor for updates; no patches or workarounds are available yet.
  • Mitigation: Pending official patch, closely monitor Jetty's update announcements.

What to Do Now

  1. Upgrade OAuth2 Proxy and Thymeleaf to the latest versions immediately.
  2. Reconfigure reverse proxies to handle X-Forwarded-Uri headers securely.
  3. Audit applications for unvalidated input passed to template engines.
  4. Monitor Jetty installations for unusual activity and await official patches.

Related Resources

  • OAuth2 Proxy GitHub Advisory
  • Thymeleaf Security Advisories
  • Jetty Blog on HTTP Request Smuggling

Keep reading