CVE-2026-52809: Gogs Auth Bypass Vulnerability

CVE-2026-52809 Overview

CVE-2026-52809 affects Gogs, an open source self-hosted Git service. The vulnerability stems from incorrect token lifetime handling in the password-reset workflow. Versions prior to 0.14.3 generate password-reset tokens using conf.Auth.ActivateCodeLives, the account-activation lifetime, instead of conf.Auth.ResetPasswordCodeLives. The token lifetime is embedded at generation time and re-extracted at verification time, making the RESET_PASSWORD_CODE_LIVES configuration setting irrelevant to actual enforcement. Administrators who configure shorter reset windows for compliance reasons cannot rely on those policies. Reset tokens remain valid for the full activation lifetime while emails advertise the shorter expiry. This issue is fixed in version 0.14.3 and classified under [CWE-324]: Use of a Key Past its Expiration Date.

Critical Impact
Password reset tokens remain exploitable far beyond the configured expiry window, expanding the time available for attackers to abuse intercepted or leaked reset links.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service deployments
Instances with custom RESET_PASSWORD_CODE_LIVES configurations

Discovery Timeline

2026-06-24 - CVE-2026-52809 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52809

Vulnerability Analysis

The flaw resides in the password-reset token generation logic of Gogs. The function constructs tokens by encoding the expiry timestamp directly into the token payload. The expiry value is sourced from conf.Auth.ActivateCodeLives, the variable governing email activation links for newly registered accounts. The reset workflow should instead reference conf.Auth.ResetPasswordCodeLives.

Because the token carries its own lifetime, verification logic trusts the embedded value rather than rechecking server policy. This decouples the active token validity from the documented configuration. Administrators setting a 10-minute reset window unknowingly issue tokens valid for hours or days, depending on activation defaults.

The reset email further compounds the issue by displaying the configured RESET_PASSWORD_CODE_LIVES value to recipients. Users and auditors receive false assurance that the link expires within the advertised window.

Root Cause

The root cause is a configuration reference error in the token generator. Developers used the wrong constant when assembling the reset token, conflating two separate lifetime policies. Combined with self-describing token design, the bug bypasses any server-side enforcement of the intended reset policy.

Attack Vector

Exploitation requires an attacker to obtain a valid password-reset token. Attack scenarios include interception of reset emails through compromised mail forwarding, access to shared mailboxes, or reuse of tokens leaked through logs and referer headers. User interaction is required because the victim must initiate a reset, or the attacker must initiate one against a target account. The extended lifetime materially widens the exploitation window.

No public proof-of-concept exploit is associated with CVE-2026-52809. The vulnerability is described in prose in the upstream GitHub Security Advisory GHSA-5c3f-6486-3g7g.

Detection Methods for CVE-2026-52809

Indicators of Compromise

Password reset events succeeding well after the advertised expiry window stated in reset emails
Repeated reset requests for high-value accounts followed by successful authentication from unfamiliar IP addresses
Audit log entries showing token consumption hours or days after issuance

Detection Strategies

Compare Gogs version strings against 0.14.3 across inventory to identify vulnerable hosts
Correlate /user/reset_password requests with the timestamp of the originating /user/forgot_password event to identify long-lived token use
Alert on password resets followed by SSH key additions or repository permission changes within a short interval

Monitoring Recommendations

Forward Gogs application logs and HTTP access logs to a centralized logging platform for time-window correlation
Track configuration drift on RESET_PASSWORD_CODE_LIVES and ACTIVATE_CODE_LIVES to detect attempts to mask the issue
Monitor outbound email gateways for reset notifications and validate effective expiry against policy

How to Mitigate CVE-2026-52809

Immediate Actions Required

Upgrade all Gogs deployments to version 0.14.3 or later, as published in the Gogs v0.14.3 release notes
Invalidate outstanding password reset tokens by restarting the service after upgrade
Audit recent password reset and account recovery events for anomalies during the unintended extended validity window

Patch Information

The maintainers fixed CVE-2026-52809 in Gogs 0.14.3 by referencing conf.Auth.ResetPasswordCodeLives during reset token generation. Details are documented in the GitHub Security Advisory GHSA-5c3f-6486-3g7g. Operators should apply the upgrade as the primary remediation.

Workarounds

Temporarily set ACTIVATE_CODE_LIVES to the same short duration intended for password resets, accepting that activation links will also expire faster
Restrict access to the Gogs web interface using network controls or a reverse proxy with authentication while patching is scheduled
Communicate to users that reset links should be used immediately and discarded if not consumed

bash

# Configuration example: align activation lifetime with reset lifetime as a temporary workaround
# /etc/gogs/conf/app.ini
[security]
ACTIVATE_CODE_LIVES = 10
RESET_PASSWORD_CODE_LIVES = 10