{"id":"CVE-2026-25119","aliases":["GHSA-w6j9-vw59-27wv","GO-2026-5695"],"url":"https://o3.security/vulnerability/CVE-2026-25119","summary":"Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers","details":"## Summary\n\nWhen `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (default: `X-WEBAUTH-USER`) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication.\n\n## Root Cause\n\nThe vulnerability exists because Gogs reads the authentication header directly from the incoming HTTP request without any verification that the header was set by a trusted reverse proxy.\n\n### Vulnerable Code Flow\n\nIn `internal/context/auth.go` lines 206-234:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n // ... existing auth checks ...\n\n if uid <= 0 {\n if conf.Auth.EnableReverseProxyAuthentication {\n // Reads header DIRECTLY from client request - NO VALIDATION!\n webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n if len(webAuthUser) > 0 {\n user, err := store.GetUserByUsername(ctx.Req.Context(), webAuthUser)\n if err != nil {\n if !database.IsErrUserNotExist(err) {\n log.Error(\"Failed to get user by name: %v\", err)\n return nil, false, false\n }\n\n // Check if enabled auto-registration.\n if conf.Auth.EnableReverseProxyAutoRegistration {\n // Creates new user with forged username!\n user, err = store.CreateUser(\n ctx.Req.Context(),\n webAuthUser,\n gouuid.NewV4().String()+\"@localhost\",\n database.CreateUserOptions{\n Activated: true,\n },\n )\n if err != nil {\n log.Error(\"Failed to create user %q: %v\", webAuthUser, err)\n return nil, false, false\n }\n }\n }\n // Returns user as authenticated without any verification!\n return user, false, false\n }\n }\n // ... fallback to basic auth ...\n }\n // ...\n}\n```\n\nThe code has **zero validation** that:\n1. The request came through a reverse proxy\n2. The header was set by the proxy (not the client)\n3. Gogs is actually behind a reverse proxy\n4. The direct access to Gogs is restricted\n\nThe vulnerability occurs when:\n- Gogs is publicly accessible (e.g., `0.0.0.0:3000`)\n- `ENABLE_REVERSE_PROXY_AUTHENTICATION = true`\n\n## Proof of Concept\n\n### Prerequisites\n\nGogs instance with the following configuration in `custom/conf/app.ini`:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = true\n```\n\nAn attacker can impersonate any user including administrators:\n\n```bash\n# Become admin instantly\ncurl http://gogs.example.com/ -H \"X-WEBAUTH-USER: \"\n```\n\n\"impersonation_example\"\n\n## Recommended Fixes\n\nAdd validation to ensure headers come from trusted sources:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n // ... existing code ...\n\n if uid <= 0 {\n if conf.Auth.EnableReverseProxyAuthentication {\n // Validate request is from trusted proxy\n if !isRequestFromTrustedProxy(ctx.Req) {\n log.Warn(\"Reverse proxy auth header received from untrusted source: %s\", ctx.RemoteAddr())\n return nil, false, false\n }\n\n webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n // ... rest of the code ...\n }\n }\n // ...\n}\n\n// New validation function\nfunc isRequestFromTrustedProxy(req *http.Request) bool {\n // Check if request is from localhost/trusted IPs\n remoteIP := getRemoteIP(req)\n\n // Only accept from localhost by default\n if remoteIP.IsLoopback() {\n return true\n }\n\n // Check against configured trusted proxy IPs\n for _, trustedIP := range conf.Auth.TrustedProxyIPs {\n if remoteIP.String() == trustedIP {\n return true\n }\n }\n\n return false\n}\n```\n\nAdd configuration option:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = false\nREVERSE_PROXY_AUTHENTICATION_HEADER = X-WEBAUTH-USER\n; Comma-separated list of trusted proxy IPs (default: 127.0.0.1)\nTRUSTED_PROXY_IPS = 127.0.0.1,::1\n; Whether to require trusted proxy validation (recommended: true)\nREQUIRE_TRUSTED_PROXY = true\n```\n\n## References\n\n- [CWE-290: Authentication Bypass by Spoofing](https://cwe.mitre.org/data/definitions/290.html)\n- [OWASP: Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)\n- [OWASP Top 10 2021 - A07: Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)","published":"2026-06-24T20:07:32.497Z","modified":"2026-08-12T03:51:09.835091534Z","cvss":null,"epss":{"score":0.00863,"percentile":0.56887,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"gogs.io/gogs","fixedVersion":"0.14.3"}],"fix":{"url":"https://github.com/gogs/gogs/commit/0089c4c8e5b8d99eb6e5c8727f8f40d765f1f58a","label":"gogs/gogs@0089c4c"},"references":[{"type":"WEB","url":"https://github.com/gogs/gogs/releases/tag/v0.14.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25119.json"},{"type":"ADVISORY","url":"https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25119"},{"type":"FIX","url":"https://github.com/gogs/gogs/commit/0089c4c8e5b8d99eb6e5c8727f8f40d765f1f58a"},{"type":"FIX","url":"https://github.com/gogs/gogs/pull/8264"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:09.835091534Z"}}