CVE-2026-25119: Gogs Auth Bypass Vulnerability

CVE-2026-25119 Overview

CVE-2026-25119 is an authentication bypass vulnerability in Gogs, an open source self-hosted Git service. When ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests. The service fails to validate that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation. The flaw affects versions prior to 0.14.3 and is tracked under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated remote attackers can impersonate arbitrary users, including administrators, by setting a single HTTP header — completely bypassing authentication on exposed Gogs instances.

Affected Products

Gogs versions prior to 0.14.3
Deployments with ENABLE_REVERSE_PROXY_AUTHENTICATION = true
Self-hosted Gogs Git service instances exposed without a fronting trusted proxy

Discovery Timeline

2026-06-24 - CVE-2026-25119 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-25119

Vulnerability Analysis

Gogs supports authentication delegation to a fronting reverse proxy through the ENABLE_REVERSE_PROXY_AUTHENTICATION configuration option. When this option is active, Gogs reads the username from the HTTP header defined by REVERSE_PROXY_AUTHENTICATION_HEADER, which defaults to X-WEBAUTH-USER. The application treats the value of this header as an authenticated identity.

Before version 0.14.3, Gogs performed no validation of the request source. The application accepted the header from any client, including direct connections that bypassed the intended reverse proxy. An attacker sending X-WEBAUTH-USER: admin to the Gogs HTTP endpoint authenticates as the admin account without supplying credentials. If ENABLE_REVERSE_PROXY_AUTO_REGISTRATION is also enabled, attackers can trigger creation of arbitrary new accounts.

Root Cause

The root cause is an implicit trust assumption in the request-handling pipeline. Gogs assumed the deployment topology placed a reverse proxy between clients and the service, and that the proxy stripped or overwrote the authentication header. No network-layer or application-layer enforcement validated this assumption. The fix in commit 0089c4c8 introduces a TRUSTED_PROXY_IPS setting that restricts header trust to configured IPs or CIDR ranges.

Attack Vector

Exploitation requires only network reachability to the Gogs HTTP service. An attacker sends a standard HTTP request with a forged X-WEBAUTH-USER header set to a target username. Gogs accepts the request, establishes a session for the named user, and grants access to that user's repositories and administrative functions where applicable.

text

 ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
 ; The HTTP header used as username for reverse proxy authentication.
 REVERSE_PROXY_AUTHENTICATION_HEADER = X-WEBAUTH-USER
+; Lists the IPs or CIDR ranges whose requests are allowed to set the reverse
+; proxy authentication header.
+TRUSTED_PROXY_IPS = 127.0.0.0/8,::1/128

 [user]
 ; Whether to enable email notifications for users.

Source: Gogs commit 0089c4c8 — adds TRUSTED_PROXY_IPS to restrict which source addresses can set the authentication header.

Detection Methods for CVE-2026-25119

Indicators of Compromise

HTTP requests containing the X-WEBAUTH-USER header arriving from source IPs outside the documented reverse proxy infrastructure
Unexpected creation of new Gogs accounts correlated with the reverse-proxy auto-registration code path
Authentication events for privileged accounts without corresponding password authentication or 2FA challenge records
Repository access from session IDs whose creation lacks a credential validation entry in application logs

Detection Strategies

Inspect Gogs access logs and upstream load balancer logs for the configured authentication header on requests bypassing the trusted proxy chain
Correlate new user creation events with the originating source IP and HTTP headers to identify auto-registration abuse
Alert on Gogs administrative actions (user role changes, SSH key additions, repository visibility changes) performed by sessions established via the reverse-proxy code path

Monitoring Recommendations

Enable verbose authentication logging in Gogs and forward logs to a centralized SIEM for retention and correlation
Monitor for unusual Git clone, push, or API activity tied to accounts that authenticated via the reverse-proxy header
Track the version banner of Gogs deployments and alert on instances running versions earlier than 0.14.3

How to Mitigate CVE-2026-25119

Immediate Actions Required

Upgrade Gogs to version 0.14.3 or later, which introduces the TRUSTED_PROXY_IPS allowlist
If upgrade is not immediately possible, disable ENABLE_REVERSE_PROXY_AUTHENTICATION in app.ini until patching is complete
Audit existing user accounts for unauthorized additions created via auto-registration
Rotate session tokens, SSH keys, and access tokens for any account that may have been impersonated

Patch Information

The fix is included in Gogs v0.14.3. The relevant change was introduced in pull request #8264 and committed in 0089c4c8. Full details are available in the GitHub Security Advisory GHSA-w6j9-vw59-27wv.

Workarounds

Restrict network access to the Gogs HTTP port so only the trusted reverse proxy can reach it, using host-based firewall rules or a private network segment
Configure the fronting reverse proxy to unconditionally strip or overwrite the X-WEBAUTH-USER header from client requests before forwarding
After upgrading, explicitly set TRUSTED_PROXY_IPS to the exact IPs or CIDR ranges of legitimate proxies instead of relying on defaults

bash

# Example app.ini hardening after upgrading to Gogs 0.14.3
[auth]
ENABLE_REVERSE_PROXY_AUTHENTICATION = true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
REVERSE_PROXY_AUTHENTICATION_HEADER = X-WEBAUTH-USER
# Restrict trust to specific proxy addresses
TRUSTED_PROXY_IPS = 127.0.0.0/8,::1/128,10.0.0.5/32