Open Source Git Service Vulnerability in Gogs Affects URL Redirection

CVE-2026-82402

What is CVE-2026-82402?

Gogs, a self-hosted Git service, contains a vulnerability in its /redirect endpoint that permits unauthenticated attackers to exploit URL handling. Prior to version 0.15.0+dev, a specially crafted backslash-containing URL can manipulate the redirection behavior, leading to potential phishing threats. This occurs because the system improperly normalizes the URL, allowing attackers to direct users from a trusted Gogs domain to malicious sites. The flaw has been addressed in later releases.

References