CVE-2026-52802: Gogs Auth Bypass Vulnerability

CVE-2026-52802 Overview

CVE-2026-52802 is an open redirect vulnerability in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 fail to properly validate the redirect_to parameter. The IsSameSite function inspects only the first two characters of a URL string and does not account for directory traversal sequences combined with backslashes. Attackers can craft URLs that pass validation and redirect users to arbitrary external sites. The flaw is tracked as CWE-601 (URL Redirection to Untrusted Site). Maintainers fixed the issue in Gogs 0.14.3.

Critical Impact
Attacker-controlled redirect_to parameters bypass same-site validation, enabling phishing and credential-harvesting workflows against authenticated Gogs users.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service deployments
Any application path in Gogs that relies on the IsSameSite function for redirect validation

Discovery Timeline

2026-06-24 - CVE-2026-52802 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52802

Vulnerability Analysis

The vulnerability resides in the IsSameSite function located in internal/urlx/urlx.go. The function was intended to confirm that a redirect target is local to the Gogs instance. It returned true whenever the URL began with / and the second character was neither / nor \. This minimal check did not normalize encoded characters or traversal sequences. Attackers can supply a redirect_to value such as /\evil.com using URL-encoded backslashes (%5C) or combine directory traversal with backslashes to escape the same-origin assumption. The browser then resolves the path against an external host. The vulnerability does not require authentication, but user interaction is required because the victim must click the crafted link.

Root Cause

The root cause is incomplete input validation. The original IsSameSite implementation inspected raw bytes and did not decode %5C, normalize backslashes to forward slashes, or strip control characters such as \t, \n, and \r. Browsers interpret these characters when parsing URLs, but the validator did not.

Attack Vector

An attacker constructs a phishing link to a legitimate Gogs host with a manipulated redirect_to parameter. The victim authenticates or interacts with Gogs, and the application redirects them to the attacker-controlled domain. The attacker then serves a credential-harvesting page that imitates the Gogs login flow.

// Security patch in internal/urlx/urlx.go
 package urlx
 
+import "strings"
+
 // IsSameSite returns true if the URL path belongs to the same site.
-func IsSameSite(url string) bool {
-	return len(url) >= 2 && url[0] == '/' && url[1] != '/' && url[1] != '\\'
+func IsSameSite(rawURL string) bool {
+	p := strings.NewReplacer(
+		`\`, "/", "%5C", "/", "%5c", "/",
+		"\t", "", "\n", "", "\r", "",
+	).Replace(rawURL)
+	return strings.HasPrefix(p, "/") && !strings.Contains(p, "//")
 }

Source: Gogs commit c5da9631. The patch normalizes encoded and literal backslashes to forward slashes, strips control characters, and rejects any URL that contains // after normalization.

Detection Methods for CVE-2026-52802

Indicators of Compromise

Inbound HTTP requests to Gogs endpoints containing redirect_to values with encoded backslashes such as %5C or %5c.
Access log entries containing redirect_to parameters that resolve to external hostnames after URL decoding.
Requests containing embedded control characters (\t, \n, \r) inside redirect_to query values.

Detection Strategies

Inspect web server and reverse proxy logs for redirect_to parameters that decode to URLs outside the Gogs origin.
Deploy a Web Application Firewall (WAF) rule that flags redirect_to values containing \, %5C, or traversal sequences.
Correlate redirect responses (HTTP 302) issued by Gogs with Location headers pointing to untrusted domains.

Monitoring Recommendations

Forward Gogs access logs to a central log platform and alert on anomalous redirect_to query strings.
Track outbound redirect destinations from authenticated Gogs sessions and baseline expected internal paths.
Monitor for spikes in 302 responses with Location headers referencing external domains.

How to Mitigate CVE-2026-52802

Immediate Actions Required

Upgrade all Gogs instances to version 0.14.3 or later without delay.
Audit recent web server logs for suspicious redirect_to parameter values targeting users.
Notify Gogs users of the phishing risk and remind them to verify destination URLs after authentication.

Patch Information

The fix is published in Gogs Release v0.14.3 and merged via Pull Request #8322. Additional context is available in the GitHub Security Advisory GHSA-xxhq-69mf-w8cr. The patch rewrites IsSameSite to normalize backslashes and encoded variants, strip control characters, and reject any input containing // after normalization.

Workarounds

Place Gogs behind a reverse proxy that strips or rejects redirect_to parameters containing backslashes or %5C sequences.
Disable or override redirect flows in deployments where upgrade is delayed by enforcing strict allow-lists for redirect targets.
Educate users to inspect the URL bar after login and to avoid clicking Gogs links from untrusted sources.

bash

# Example NGINX rule to block suspicious redirect_to values
if ($args ~* "redirect_to=[^&]*(\\|%5C|%5c)") {
    return 400;
}