src_1653fbf8e2da6d59a7
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Jun 19, 2026 06:41 UTC
- Retrieved
- Oct 08, 2026 03:51 UTC
Gogs - Authentication Bypass via Unvalidated Reverse Proxy Headers
Gogs - Authentication Bypass via Unvalidated Reverse Proxy Headers When 'ENABLE_REVERSE_PROXY_AUTHENTICATION' is enabled, Gogs accepts the configured authentication header (default: 'X-WEBAUTH-USER') directly from client requests without validating that the request originated from a trusted reverse proxy.Any remote attacker who can reach the Gogs service can forge this header to impersonate any us
Reference details
- Source category
- Research & news
- Report title
Gogs - Authentication Bypass via Unvalidated Reverse Proxy Headers- First reported
- Jun 19, 2026 06:41 UTC
- Last reported
- Jun 19, 2026 06:41 UTC
- Catalog updated
- Oct 08, 2026 03:51 UTC
- Record ID
35f205c1228943cb51df56bd1c72cb519eff1d0cf2b9d5fc5709c2c1ad0be8a4
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.