openshift/oauth-proxy does not strip client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) on paths that bypass authentication via skip-auth-regex. The ServeHTTP function (oauthproxy.go:568) routes whitelisted requests directly to the upstream via p.serveMux.ServeHTTP(rw, req) at lines 574-575, bypassing the Authenticate() function entirely. No header stripping logic exists anywhere in the codebase. An unauthenticated attacker can inject forged identity headers that are forwarded to the upstream application, enabling audit log poisoning and potential authorization bypass on whitelisted paths. The community oauth2-proxy project fixed this in PR #624 (July 2020) with --skip-auth-strip-headers (default: true), but this was never ported to openshift/oauth-proxy.