CVE-2025-64175: Gogs Auth Bypass Vulnerability

CVE-2025-64175 Overview

CVE-2025-64175 is an authentication bypass vulnerability in Gogs, an open source self-hosted Git service. The vulnerability exists in Gogs' two-factor authentication (2FA) recovery code validation mechanism, which fails to properly scope recovery codes by user. This critical flaw enables attackers who know a victim's username and password to bypass 2FA protections using any unused recovery code, including codes from their own account.

Critical Impact

Complete account takeover is possible, rendering 2FA protections ineffective across all Gogs environments where two-factor authentication is enabled.

Affected Products

• Gogs version 0.13.3 and prior

Discovery Timeline

• 2026-02-06 - CVE CVE-2025-64175 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2025-64175

Vulnerability Analysis

This vulnerability is classified as CWE-287 (Improper Authentication). The core issue lies in how Gogs validates 2FA recovery codes during the authentication process. When a user attempts to authenticate using a recovery code instead of their standard 2FA token, the system checks if the provided recovery code exists and is unused, but critically fails to verify that the recovery code belongs to the account being accessed.

This authentication bypass occurs because recovery codes are validated globally rather than being scoped to individual user accounts. An attacker with knowledge of valid credentials (username and password) can leverage this flaw to completely circumvent 2FA protections.

Root Cause

The root cause is improper input validation and inadequate authentication controls in the 2FA recovery code verification logic. The recovery code lookup query does not include the user identifier as a constraint, allowing any valid unused recovery code from any account to satisfy the verification check. This represents a fundamental failure to implement proper user-scoped validation for sensitive authentication mechanisms.

Attack Vector

The attack vector is network-based and requires the attacker to possess the victim's username and password. The exploitation sequence involves:

1. The attacker registers their own Gogs account and obtains their 2FA recovery codes
2. The attacker acquires the victim's username and password through credential theft, phishing, or data breach exposure
3. When prompted for 2FA verification on the victim's account, the attacker provides one of their own unused recovery codes
4. The vulnerable validation logic accepts the attacker's recovery code as valid for the victim's account
5. The attacker gains full access to the victim's account, bypassing 2FA entirely

The attack requires low privilege (a valid Gogs account) and no user interaction from the victim. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-64175

Indicators of Compromise

• Successful authentication events using 2FA recovery codes where the recovery code does not belong to the authenticating user
• Unexpected login activity or session creation for accounts with 2FA enabled
• Authentication audit logs showing recovery code usage from unfamiliar IP addresses or locations
• Multiple accounts experiencing 2FA bypasses within a short timeframe

Detection Strategies

• Implement correlation rules to detect when 2FA recovery codes are used and cross-reference them against the user account's assigned recovery codes
• Monitor for anomalous login patterns where users successfully authenticate with 2FA recovery codes following failed TOTP attempts
• Audit authentication logs for accounts where recovery code authentication occurs from new or suspicious IP addresses
• Deploy behavioral analytics to identify accounts showing sudden changes in access patterns after 2FA bypass

Monitoring Recommendations

• Enable verbose logging for all 2FA-related authentication events in Gogs
• Implement real-time alerting for any recovery code authentication attempts
• Monitor for bulk login attempts targeting multiple accounts with similar timing patterns
• Review Gogs version information across your deployment to identify vulnerable instances running version 0.13.3 or prior

How to Mitigate CVE-2025-64175

Immediate Actions Required

• Upgrade Gogs to version 0.13.4 or 0.14.0+dev immediately
• Audit authentication logs for any suspicious recovery code usage
• Force regeneration of 2FA recovery codes for all users after patching
• Consider temporarily disabling 2FA recovery code authentication if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Gogs versions 0.13.4 and 0.14.0+dev. Organizations should upgrade to these patched versions as soon as possible. For additional details, see the GitHub Security Advisory.

Workarounds

• If immediate patching is not feasible, consider disabling the 2FA recovery code feature at the application level
• Implement network-level access controls to restrict Gogs access to trusted IP ranges
• Require additional verification for account access from new devices or locations
• Deploy a web application firewall (WAF) to add an additional authentication layer in front of Gogs

# Verify current Gogs version
gogs --version

# Backup current installation before upgrade
tar -czvf gogs-backup-$(date +%Y%m%d).tar.gz /path/to/gogs

# Upgrade to patched version (example using binary installation)
wget https://github.com/gogs/gogs/releases/download/v0.13.4/gogs_0.13.4_linux_amd64.tar.gz
tar -xzvf gogs_0.13.4_linux_amd64.tar.gz
systemctl restart gogs