{"id":"CVE-2026-25119","title":"Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers","summary":"Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers","severity":"high","cwe":["CWE-290"],"vendor":"gogs","product":"gogs.io/gogs","ecosystem":"go","affected":["gogs.io/gogs <= 0.14.2"],"patched":["gogs.io/gogs 0.14.3"],"published":"2026-06-22","updated":"2026-06-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-w6j9-vw59-27wv","references":[{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv"},{"url":"https://github.com/gogs/gogs/pull/8264"},{"url":"https://github.com/gogs/gogs/commit/0089c4c8e5b8d99eb6e5c8727f8f40d765f1f58a"},{"url":"https://github.com/gogs/gogs/releases/tag/v0.14.3"},{"url":"https://github.com/advisories/GHSA-w6j9-vw59-27wv"}],"tags":["ghsa","go"],"epss":0.00863,"epssPercentile":0.57092,"ingestedAt":"2026-06-29T13:24:35.662Z","slug":"CVE-2026-25119","body":"## Overview\n\n## Summary\n\nWhen `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (default: `X-WEBAUTH-USER`) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication.\n\n## Root Cause\n\nThe vulnerability exists because Gogs reads the authentication header directly from the incoming HTTP request without any verification that the header was set by a trusted reverse proxy.\n\n### Vulnerable Code Flow\n\nIn `internal/context/auth.go` lines 206-234:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n // ... existing auth checks ...\n\n if uid <= 0 {\n if conf.Auth.EnableReverseProxyAuthentication {\n // Reads header DIRECTLY from client request - NO VALIDATION!\n webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n if len(webAuthUser) > 0 {\n user, err := store.GetUserByUsername(ctx.Req.Context(), webAuthUser)\n if err != nil {\n if !database.IsErrUserNotExist(err) {\n log.Error(\"Failed to get user by name: %v\", err)\n return nil, false, false\n }\n\n // Check if enabled auto-registration.\n if conf.Auth.EnableReverseProxyAutoRegistration {\n // Creates new user with forged username!\n user, err = store.CreateUser(\n ctx.Req.Context(),\n webAuthUser,\n gouuid.NewV4().String()+\"@localhost\",\n database.CreateUserOptions{\n Activated: true,\n },\n )\n if err != nil {\n log.Error(\"Failed to create user %q: %v\", webAuthUser, err)\n return nil, false, false\n }\n }\n }\n // Returns user as authenticated without any verification!\n return user, false, false\n }\n }\n // ... fallback to basic auth ...\n }\n // ...\n}\n```\n\nThe code has **zero validation** that:\n1. The request came through a reverse proxy\n2. The header was set by the proxy (not the client)\n3. Gogs is actually behind a reverse proxy\n4. The direct access to Gogs is restricted\n\nThe vulnerability occurs when:\n- Gogs is publicly accessible (e.g., `0.0.0.0:3000`)\n- `ENABLE_REVERSE_PROXY_AUTHENTICATION = true`\n\n## Proof of Concept\n\n### Prerequisites\n\nGogs instance with the following configuration in `custom/conf/app.ini`:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = true\n```\n\nAn attacker can impersonate any user including administrators:\n\n```bash\n# Become admin instantly\ncurl http://gogs.example.com/ -H \"X-WEBAUTH-USER: \"\n```\n\n\"impersonation_example\"\n\n## Recommended Fixes\n\nAdd validation to ensure headers come from trusted sources:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n // ... existing code ...\n\n if uid <= 0 {\n if conf.Auth.EnableReverseProxyAuthentication {\n // Validate request is from trusted proxy\n if !isRequestFromTrustedProxy(ctx.Req) {\n log.Warn(\"Reverse proxy auth header received from untrusted source: %s\", ctx.RemoteAddr())\n return nil, false, false\n }\n\n webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n // ... rest of the code ...\n }\n }\n // ...\n}\n\n// New validation function\nfunc isRequestFromTrustedProxy(req *http.Request) bool {\n // Check if request is from localhost/trusted IPs\n remoteIP := getRemoteIP(req)\n\n // Only accept from localhost by default\n if remoteIP.IsLoopback() {\n return true\n }\n\n // Check against configured trusted proxy IPs\n for _, trustedIP := range conf.Auth.TrustedProxyIPs {\n if remoteIP.String() == trustedIP {\n return true\n }\n }\n\n return false\n}\n```\n\nAdd configuration option:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = false\nREVERSE_PROXY_AUTHENTICATION_HEADER = X-WEBAUTH-USER\n; Comma-separated list of trusted proxy IPs (default: 127.0.0.1)\nTRUSTED_PROXY_IPS = 127.0.0.1,::1\n; Whether to require trusted proxy validation (recommended: true)\nREQUIRE_TRUSTED_PROXY = true\n```\n\n## References\n\n- [CWE-290: Authentication Bypass by Spoofing](https://cwe.mitre.org/data/definitions/290.html)\n- [OWASP: Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)\n- [OWASP Top 10 2021 - A07: Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n\n## Affected packages\n\n- `gogs.io/gogs <= 0.14.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `gogs.io/gogs 0.14.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}