Identity impersonation via underscore header smuggling

Header smuggling in openshift/oauth-proxy in Red Hat OpenShift Container Platform allows remote authenticated users to impersonate upstream users. The proxy writes trusted identity headers only in dash form, such as X-Forwarded-User, and strips only those names, while Go stores X-Forwarded-User and X_Forwarded_User as different keys and WSGI and PHP normalize both into the same CGI variable. Exploitation requires authenticated access through oauth-proxy and an upstream application that consumes those forwarded identity headers for authorization; the exposure is upstream impersonation and possible privilege escalation, not a bypass of oauth-proxy's own login flow.