CVE-2023-43660 SSH key password bypassed in warpgate

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the...

CVE-2023-43660

Warpgate (Linux bastion for SSH/HTTPS/MySQL) contains an authentication bypass where an unsigned SSH key offer can bypass user key verification. The issue requires the attacker to know the username and a valid target name, and that only SSH public key authentication is used for the user account. ...

CVE-2023-43660: Improper Authentication

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the...

Warpgate Data Forgery Issue Vulnerability

Warpgate is an intelligent SSH, HTTPS and MySQL bastion host for Linux from the warp-tech project. A data forgery issue vulnerability exists in Warpgate versions prior to 0.8.0, which stems from the ability to bypass a user's SSH key authentication by sending unsigned SSH key offers...

PT-2023-6507 · Warpgate · Warpgate

Name of the Vulnerable Software and Affected Versions: Warpgate versions prior to 0.8.1 Description: The issue is related to errors in cryptographic signature verification, allowing a remote attacker to bypass the authentication process under certain conditions. Specifically, the SSH key...

CVE-2023-37268

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been...

Authentication flaw

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been...

CVE-2023-37268 User login confusion with SSO in warpgate

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been...

CVE-2023-37268 User login confusion with SSO in warpgate

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been...

CVE-2023-37268 User login confusion with SSO in warpgate

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been...

CVE-2023-37268

CVE-2023-37268 affects Warpgate, a Linux bastion host providing SSH/HTTPS/MySQL access. The issue allows an attacker to log in as another user when the attacker’s account uses SSO, enabling credential-forgery if the target account has no second factor. The root cause is an authorization flaw tied...

PT-2023-25871 · Warpgate · Warpgate

Name of the Vulnerable Software and Affected Versions: Warpgate versions prior to 0.7.3 Description: Warpgate is an SSH, HTTPS, and MySQL bastion host for Linux that does not require special client apps. An issue exists where an attacker may authenticate as another user when logging in as a user...

CVE-2023-37268: Improper Authentication

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been...