High · published February 6, 2026
⚡ Gophish has a surprisingly sneaky flaw that exposes your long-lived API keys right in the HTML on every login! 🔓 Think of it like leaving your house keys out on the front porch — anyone passing by can pick them up and walk right in! In this case, any script running in the browser can access those API credentials without any barriers. An attacker could exploit this vulnerability to gain unauthorized access to sensitive API operations, potentially leading to a complete compromise of your Gophish instance. With these API keys, they could perform actions as if they were an admin, dramatically increasing the risk of data loss or abuse.
Think of it like leaving your house keys out on the front porch — anyone passing by can pick them up and walk right in! In this case, any script running in the browser can access those API credentials without any barriers. This issue arises from incorrect access control, where the API keys are rendered directly in the page's HTML/JavaScript content upon login, making them readily accessible to any scripts running in the user's browser.
An attacker could exploit this vulnerability to gain unauthorized access to sensitive API operations, potentially leading to a complete compromise of your Gophish instance. With these API keys, they could perform actions as if they were an admin, dramatically increasing the risk of data loss or abuse. Update Gophish to version 0.12.2 or later immediately to secure your instance. Additionally, consider reviewing your code to audit any other sensitive information being exposed on the frontend and apply proper access controls. You've got this! Follow these steps and you’ll have your defenses strengthened in no time. 🛡️