openshift/oauth-proxy sets authenticated identity headers using dash-variant keys only (req.Header["X-Forwarded-User"] at oauthproxy.go:810,816) but does not strip underscore-variant keys (X_Forwarded_User) from client requests. Go's http.Header treats these as separate keys via textproto.CanonicalMIMEHeaderKey. WSGI frameworks (Django, Flask, FastAPI) and PHP normalize both to the same CGI variable (HTTP_X_FORWARDED_USER per PEP 3333), allowing a low-privilege authenticated attacker to inject X_Forwarded_User: admin which may override the proxy-set authenticated identity in the upstream application. The community oauth2-proxy fixed this in v7.13.0 (CVE-2025-64484, GHSA-vjrc-mh2v-45x6) with header normalization. This fix was never ported to openshift/oauth-proxy.