CVE-2026-20896

CVE-2026-20896 Gitea's official Docker image up to and including 1.26.2 ships REVERSEPROXYTRUSTEDPROXIES = in its default config. If you turn on reverse-proxy login, that wildcard means every source IP is treated as a trusted proxy, so anyone who can reach the port can send an X-WEBAUTH-USER head...

cve-2026-20896-gitea-poc

CVE-2026-20896 Gitea Docker Auth Bypass Checker Authorized red team / pentest operations only. This repository contains a minimal checker for CVE-2026-20896, an authentication bypass in official Gitea Docker images up to and including 1.26.2 when reverse-proxy authentication is enabled. What...

CVE-2026-20896

CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC !WARNING Use this PoC only in a local lab or against a system you are explicitly authorized to test. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Overview CVE-2026-20896 is an authentication bypass in...

Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass

The official Gitea Docker image through version 1.26.2 ships with REVERSEPROXYTRUSTEDPROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers X-WEBAUTH-USER from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy...

CVE-2026-20896

CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC !WARNING Use this PoC only in a local lab or against a system you are explicitly authorized to test. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Overview CVE-2026-20896 is an authentication bypass in...

Exploit for CVE-2026-20896

CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC...

Exploit for CVE-2026-20896

CVE-2026-20896 - Gitea ≤1.26.2 Authentication Bypass 1. What...

CVE-2026-20896 — Updated!

CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC !WARNING Use this PoC only in a local lab or against a system you are explicitly authorized to test. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Overview CVE-2026-20896 is an authentication bypass in...

SUSE CVE-2026-20896

Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...

Exploit for CVE-2026-20896

CVE-2026-20896 Gitea Docker Auth Bypass Checker Authorized re...

Exploit for CVE-2026-20896

CVE-2026-20896 Gitea's official Docker image up to and inclu...

CVE-2026-20896 Gitea Docker image trusts spoofable reverse-proxy headers by default

Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...

CVE-2026-20896: Improper Access Control

Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...

CVE-2026-25119: Authentication Bypass by Spoofing

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

PT-2026-51429

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description When ENABLE REVERSE PROXY AUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originat...

CVE-2026-36817

The Tenda W15E wireless router (version v15.11.0.10 ) is vulnerable to a buffer overflow within the formAddWebAuthWhiteUser function. The root cause is that the software fails to properly check the size of the input when processing the webAuthWhiteUserInfo parameter, allowing an operation to go b...

CVE-2026-41070

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on SSO auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode shared library loaded by OpenVPN via the plugin...

openvpn-auth-oauth2 授权问题漏洞

OpenVPN-Auth-OAuth2 is a single-signpoint login authentication integration tool developed by Jan-Otto Kröpke. In versions 1.26.3 to 1.27.3 of OpenVPN-Auth-OAuth2, there were authorization-related vulnerabilities. These vulnerabilities occurred when clients did not support WebAuth/SSO in...

PT-2026-34525

Summary When openvpn-auth-oauth2 is deployed in the experimental plugin mode shared library loaded by OpenVPN via the plugin directive, clients that do not support WebAuth/SSO e.g., the openvpn CLI on Linux are incorrectly admitted to the VPN despite being denied by the authentication logic. The...

PT-2026-34452

Name of the Vulnerable Software and Affected Versions openvpn-auth-oauth2 versions 1.26.3 through 1.27.2 Description An authentication bypass exists when the software is deployed in experimental plugin mode. Clients that do not support WebAuth/SSO are incorrectly granted full network access witho...