CVE-2026-82402

Deferred Deferred - Pending Action

Open Redirect Vulnerability in Gogs Self-Hosted Git Service

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the target while cmd/gogs/internal/web/web.go getRedirect and other callers use the original value in the Location response. This backslash normalization mismatch lets browsers interpret the Location value as a scheme-relative external URL, allowing links on a trusted Gogs domain to redirect victims to attacker-controlled content for phishing. This vulnerability is fixed in 0.15.0+dev.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-82402

EUVD

EUVD-2026-101576

Affected Vendors & Products

Vendor	Product	Version / Range
gogs	gogs	< 0.15.0+dev

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

CVE-2026-82402 is an open redirect vulnerability in Gogs, an open-source self-hosted Git service. It affects versions before 0.15.0+dev. An unauthenticated attacker can manipulate the /redirect endpoint by including backslashes in the target URL. The IsSameSite function normalizes backslashes for validation but uses the original raw URL for the redirect. Browsers interpret the backslash as a scheme-relative URL, redirecting users to attacker-controlled domains for phishing attacks.

Detection Guidance

To detect this vulnerability, check if your Gogs instance is running a version prior to 0.15.0+dev. Use commands like 'curl -s http://your-gogs-server/redirect?url=\evil.com' to test if the server redirects to an external domain. If the response includes a Location header pointing to an external URL, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to craft malicious links that appear to come from a trusted Gogs domain. When clicked, these links redirect users to external, attacker-controlled websites without authentication. This can lead to phishing attacks, credential theft, or malware distribution. Users may unknowingly expose sensitive information or fall victim to social engineering.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling phishing attacks through open redirects. Attackers could trick users into visiting malicious sites while appearing to originate from a trusted Gogs instance, which may lead to unauthorized data access or disclosure. This could violate GDPR's requirement for secure data processing and HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately upgrade Gogs to version 0.15.0+dev or later. If upgrading is not possible, apply the patch from the official Gogs repository (commit 0aa820e6d572771551871c0b5f5f32dffc565e3e) to harden the IsSameSite validation function.

Hi! I’m here to help you understand CVE-2026-82402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70