When Proxies Become Attack Vectors Through Header Injection

CVE-2025-64484 is a header sanitization vulnerability in OAuth2-proxy: the proxy strips hyphenated security headers but fails to filter underscore variants (e.g., X_Forwarded_Email). Backend frameworks that normalize underscores to hyphens may treat these injected headers as trusted authentication headers, enabling attacker impersonation of any user (including admins) and potential header-based injection.