CVE-2026-91165: Warpgate SSO XSS Vulnerability

CVE-2026-91165 Overview

CVE-2026-91165 is an HTML injection vulnerability [CWE-79] in Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux. Versions prior to 0.27.6 fail to neutralize a script-closing sequence in the response_mode=form_post single sign-on (SSO) return path implemented in warpgate-protocol-http/src/api/sso_provider_list.rs. Attacker-controlled data can reach the interstitial script block through the next redirect parameter or through identity provider (IdP) derived error messages. The Warpgate Content-Security-Policy (CSP) blocks injected JavaScript and event handlers, so the practical impact is limited to content spoofing, false login forms, or a meta refresh.

Critical Impact
An authenticated attacker who controls SSO inputs can render spoofed markup inside the SSO POST interstitial after a victim completes the form_post flow.

Affected Products

Warpgate versions prior to 0.27.6
warpgate-protocol-http component (SSO provider list and detail handlers)
Deployments using response_mode=form_post SSO with attacker-influenced IdP claims or next parameters

Discovery Timeline

2026-09-21 - CVE-2026-91165 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-91165

Vulnerability Analysis

The vulnerability resides in ReturnToSsoPostResponse within warpgate-protocol-http/src/api/sso_provider_list.rs. The handler uses serde_json::to_string to serialize values that are subsequently embedded inside an inline <script> block. serde_json::to_string escapes JSON structural characters but does not neutralize the HTML sequence </script>, allowing an attacker to break out of the script context and inject arbitrary markup into the rendered page.

Two input paths reach the sink. The first is the next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs. The second is IdP-derived error messages that make_redirect_url concatenates into the response without URL encoding. A victim must complete the form_post SSO flow for the injected markup to render.

Root Cause

The root cause is missing HTML context-aware encoding when serializing untrusted values into an inline script block. JSON serialization is not equivalent to JavaScript string escaping when the JSON is embedded in HTML, because the parser closes the script element on the first literal </script> sequence regardless of surrounding quotes.

Attack Vector

The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured IdP permits the required unvalidated claim format. Because Warpgate's CSP blocks inline JavaScript and event handlers, the injected content is limited to spoofed HTML such as a fake login form or a <meta http-equiv="refresh"> redirect. Script execution is not demonstrated.

rust

// Security patch in warpgate-common-http/src/lib.rs - CSP nonce for the single trusted inline script
/// [`WARPGATE_CSP`] with a single-use nonce added to `script-src`, for a page
/// that must run one inline script under the strict policy (the SSO POST
/// redirect interstitial). The same nonce must appear on the `<script>` tag.
pub fn warpgate_csp_with_script_nonce(nonce: &str) -> String {
    WARPGATE_CSP.replace(
        "script-src 'self';",
        &format!("script-src 'self' 'nonce-{nonce}';"),
    )
}

pub const WARPGATE_PLAYGROUND_CSP: &str = "default-src 'self'; \
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com; \
style-src 'self' 'unsafe-inline' https://unpkg.com https://fonts.googleapis.com; \

Source: GitHub Commit e94425a

The patch introduces a per-request nonce so the legitimate SSO interstitial script is allowed while any injected <script> markup remains blocked by CSP. The companion change in sso_provider_list.rs adds form_urlencoded and Uuid imports to properly encode IdP-derived values before they reach the response.

Detection Methods for CVE-2026-91165

Indicators of Compromise

SSO form_post responses containing a literal </script> sequence within values originating from the next parameter or IdP claims
HTTP requests to Warpgate SSO endpoints with next parameters containing HTML tags such as <meta>, <form>, or <script>
IdP claims (email, username) containing angle brackets or HTML control characters

Detection Strategies

Inspect Warpgate access logs for anomalous next query parameter values on SSO provider detail and list endpoints
Correlate SSO callbacks with IdP audit logs to identify claim values containing HTML metacharacters
Alert on Warpgate deployments still running versions prior to 0.27.6 via software inventory data

Monitoring Recommendations

Log and review all SSO error paths that render IdP-derived messages back to the browser
Monitor CSP violation reports from browsers accessing the Warpgate SSO interstitial
Track authentication attempts from newly configured or externally federated identity providers

How to Mitigate CVE-2026-91165

Immediate Actions Required

Upgrade Warpgate to version 0.27.6 or later, which sanitizes IdP-derived values and pins the trusted inline script with a CSP nonce
Audit all configured identity providers and remove any that are not fully trusted or that permit unvalidated email or username claim formats
Review recent SSO flows for evidence of spoofed login pages or meta-refresh redirects targeting Warpgate users

Patch Information

The fix is available in Warpgate release v0.27.6. See the GitHub Security Advisory GHSA-vvpj-p7j8-4rv4 for full details and the remediation commit e94425a for code-level changes.

Workarounds

Restrict SSO configuration to identity providers that enforce validated claim formats for email and username
Validate or strip HTML metacharacters from the next redirect parameter at an upstream reverse proxy until the upgrade is applied
Educate administrators to recognize spoofed Warpgate login interstitials and to verify SSO endpoints before submitting credentials

bash

# Verify installed Warpgate version and upgrade if below 0.27.6
warpgate --version

# Example upgrade via container image tag
docker pull ghcr.io/warp-tech/warpgate:0.27.6
docker stop warpgate && docker rm warpgate
docker run -d --name warpgate ghcr.io/warp-tech/warpgate:0.27.6