CVE-2026-91165 Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values
Attackers can inject markup into SSO return pages to spoof content or create fake login forms, requiring user interaction and specific IdP configurations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-91165?
CVE-2026-91165 is a low-severity cross-site scripting vulnerability in warp-tech warpgate, published on 21 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.
Weakness: CWE-79
Which versions are affected by CVE-2026-91165?
How do I fix CVE-2026-91165?
No fix has been published for CVE-2026-91165 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-91165 being exploited?
There is no known exploitation of CVE-2026-91165 in the wild and no public exploit code.
Sources
Also known as GHSA-vvpj-p7j8-4rv4.