CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
Attackers can execute arbitrary JavaScript in authenticated Warpgate sessions via a crafted SSO link, potentially stealing session data or hijacking accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-58491?
CVE-2026-58491 is a critical cross-site scripting vulnerability in warp-tech warpgate, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect. This issue is fixed in version 0.25.5.
Weakness: CWE-79
Which versions are affected by CVE-2026-58491?
How do I fix CVE-2026-58491?
No fix has been published for CVE-2026-58491 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-58491 being exploited?
There is no known exploitation of CVE-2026-58491 in the wild and no public exploit code.
Sources
Also known as GHSA-3c3w-75j2-7h74.