CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key
Attackers with valid API keys can bypass account lockout and forced password change controls in Gophish, retaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82269?
CVE-2026-82269 is a high-severity vulnerability in gophish, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
Weakness: CWE-288
Which versions are affected by CVE-2026-82269?
How do I fix CVE-2026-82269?
No fix has been published for CVE-2026-82269 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82269 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82269 exists.
Sources
Also known as GHSA-p62h-c2g7-8x23.