Critical 9.1 Bypass in OAuth2 Proxy Exposes Upstream Resources

**Executive summary:** A critical OAuth2 Proxy vulnerability (CVE-2026-34457, CVSS 9.1) can allow unauthenticated attackers to bypass authentication by spoofing health-check User-Agent strings when the proxy is used in auth_request mode with --ping-user-agent or --gcp-healthchecks enabled; affected deployments should upgrade to v7.15.2 or apply mitigations (disable the flags, sanitize User-Agent headers at the reverse proxy, or use isolated path-based health checks).