CVE-2026-25119
2026-06-24
21h16 +00:00
21h16 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication. This vulnerability is fixed in 0.14.3.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Authentication Bypass by Spoofing This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
