Impersonation Vulnerability in Gogs Git Service

CVE-2026-25119

What is CVE-2026-25119?

Gogs, the open source self-hosted Git service, has a vulnerability that allows a remote attacker to bypass authentication mechanisms. When the ENABLE_REVERSE_PROXY_AUTHENTICATION setting is enabled, Gogs accepts the configured authentication header from client requests without validating its source. This flaw enables an attacker to forge the authentication header, impersonate any user, and potentially create accounts without proper verification. The vulnerability has been resolved in the 0.14.3 release of Gogs, emphasizing the need for timely updates and security practices.

References