CVE-2026-91165
Received Received - Intake

Stored XSS in Warpgate via SSO Form Post Response

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-91165
EUVD
EUVD-2026-84063

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
warpgate warpgate 0.27.6
warp_tech warpgate 0.27.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to version 0.27.6, a vulnerability exists in the SSO return path where attacker-controlled input can inject script-closing sequences into a form_post response. This allows an attacker to manipulate the displayed content, such as showing a fake login form, without executing JavaScript due to the Content-Security-Policy blocking scripts.

Detection Guidance

Detection requires checking Warpgate version and reviewing SSO form_post response handling. Verify installed version is 0.27.6 or later. Inspect SSO provider configurations for unvalidated redirect parameters or IdP-derived error messages. No specific commands are provided in the context.

Impact Analysis

This vulnerability can lead to content spoofing, where an attacker tricks users into entering credentials into a fake login form. A victim must complete the SSO flow for the attack to work. The impact is limited to misleading users visually, as JavaScript execution is blocked by the Content-Security-Policy.

Compliance Impact

This vulnerability primarily enables content spoofing or false login forms rather than direct data exposure, which may not directly violate GDPR or HIPAA. However, if exploited to deceive users into entering credentials, it could lead to unauthorized access, potentially compromising protected health or personal data under HIPAA or GDPR. The lack of script execution due to CSP limits severe impact but still poses a risk to authentication integrity.

Mitigation Strategies

Upgrade Warpgate to version 0.27.6 or later immediately. Review and restrict SSO provider configurations to prevent unvalidated redirect parameters. Validate all IdP-derived inputs and error messages for proper URL encoding. Ensure Content-Security-Policy remains enforced to block script execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91165. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart