CVE-2026-25119CWE-290

Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

High · published June 24, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication. This vulnerability is fixed in 0.14.3.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00863 · 58.2th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-06-24T20:07Z
EPSS history
Timeline
  • 24 JUN 20:07Z
    Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers
    cvelistv5