CVE-2026-82402

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82402

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82402.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82402

Aliases

GHSA-3g28-2vwg-gxq6

Published

2026-10-14T18:49:19Z

Modified

2026-10-16T02:47:49Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`

Details

Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the target while cmd/gogs/internal/web/web.go getRedirect and other callers use the original value in the Location response. This backslash normalization mismatch lets browsers interpret the Location value as a scheme-relative external URL, allowing links on a trusted Gogs domain to redirect victims to attacker-controlled content for phishing. This vulnerability is fixed in 0.15.0+dev.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82402.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "< 0.15.0+dev"
                },
                {
                    "last_affected":  "< 0.15.0+dev"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/gogs/gogs

Affected ranges

Type

GIT

Repo

https://github.com/gogs/gogs

Events

Introduced

Fixed

0aa820e6d572771551871c0b5f5f32dffc565e3e

Database specific

Show details

{
    "source":  "REFERENCES"
}

Affected versions

Other

latest-commit-build

v0.*

v0.10

v0.10.18

v0.10.8

v0.10rc

v0.11

v0.11.19

v0.11.29

v0.11.33

v0.11.34

v0.11.4

v0.11.43

v0.11.53

v0.11.66

v0.11.79

v0.11.86

v0.11.91

v0.11rc

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.5.11

v0.5.13

v0.5.2

v0.5.5

v0.5.8

v0.5.9

v0.6.1

v0.6.15

v0.6.3

v0.6.9

v0.7.0

v0.7.19

v0.7.22

v0.7.33

v0.7.6

v0.8.0

v0.8.10

v0.8.25

v0.8.43

v0.9.0

v0.9.113

v0.9.128

v0.9.13

v0.9.141

v0.9.46

v0.9.48

v0.9.60

v0.9.71

v0.9.97

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82402.json"