7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25119

CVE-2026-25119: Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25119

CVE-2026-25119:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.14.2	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an authentication bypass within the Gogs application when it is configured to use reverse proxy authentication. The root cause is the failure to validate the origin of the request before trusting the X-WEBAUTH-USER header. The function context.authenticatedUser in internal/context/auth.go would unconditionally process this header if ENABLE_REVERSE_PROXY_AUTHENTICATION was enabled. An attacker could exploit this by sending a direct request to the Gogs server with a crafted X-WEBAUTH-USER header, allowing them to impersonate any user, including administrators. The provided patch addresses this by introducing a new function, isRequestFromTrustedProxy, which checks if the request's remote address is in a list of trusted proxy IPs. The call to this function is added to the conditional check in authenticatedUser, ensuring that the reverse proxy authentication header is only honored for requests coming from a trusted source.

Vulnerable functions

context.authenticatedUser

internal/context/auth.go

The function `authenticatedUser` is responsible for handling user authentication. When the `ENABLE_REVERSE_PROXY_AUTHENTICATION` setting is enabled, this function reads the username from an HTTP header specified by `ReverseProxyAuthenticationHeader` (default `X-WEBAUTH-USER`). Prior to the patch, the function did not validate whether the request originated from a trusted reverse proxy. This allowed an unauthenticated remote attacker to directly send a request to the Gogs instance with a forged header, impersonating any user and bypassing authentication entirely. The function would then proceed to treat the request as if it came from a legitimately authenticated user.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.