7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64175

CVE-2025-64175: Gogs Vulnerable to 2FA Bypass via Recovery Code

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code (e.g., from their own account) to bypass the victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where it's enabled.. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64175

CVE-2025-64175:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	>= 0.11.19, <= 0.13.3	0.13.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the models.UseRecoveryCode function, which was introduced in commit a617d52374e937db0edacfba2a26bdd14a05538e. This function is responsible for validating a 2FA recovery code during login. The flaw lies in its database query, which searches for an unused recovery code matching the one provided, but fails to check if that code belongs to the user attempting to authenticate. The userID is passed as an argument but is ignored. This allows an attacker, who has the victim's credentials, to enter a valid, unused recovery code from their own account to bypass the victim's 2FA and gain full access. The exploit is triggered through the user.LoginTwoFactorRecoveryCodePost route handler, which calls the vulnerable UseRecoveryCode function. The patch, in commit d568e048315dc9729c8518d8085cab7dbbfac80f, rectifies this by adding the user_id to the database query, ensuring the recovery code is scoped to the correct user.

Vulnerable functions

models.UseRecoveryCode

models/two_factor.go

This function is vulnerable because it checks for the existence of a recovery code without verifying that it belongs to the user attempting to log in. The `userID` parameter is passed to the function but is ignored in the database query (`x.Where("code = ?", code)`), allowing an attacker to use a recovery code from their own account to bypass another user's 2FA.

user.LoginTwoFactorRecoveryCodePost

routers/user/auth.go

This function is the web handler that receives the recovery code from the user. It calls the vulnerable `models.UseRecoveryCode` function, making it a key component in the exploitation process. A profiler would show this function in the stack trace when the vulnerability is triggered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.