CVE-2023-35941

score

<0.1

cvss

8.6

epss

0.8%

published

2023-07-25

kev added

—

first seen

2026-10-21

Envoy versions prior to 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 contain a credential validation bypass caused by rare scenarios where HMAC payload can be always valid in OAuth2 filter's check, letting malicious clients create permanently valid credentials, exploit requires specific domain wildcard configurations.