GHSA-w6j9-vw59-27wv: Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers

Summary When ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication. Root Cause The vulnerability exists because Gogs reads the authentication header directly from the incoming HTTP request without any verification that the header was set by a trusted reverse proxy. Vulnerable Code Flow In internal/context/auth.go lines 206-234: func authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) { // ... existing auth checks ... if uid <= 0 { if conf.Auth.EnableReverseProxyAuthentication { // Reads header DIRECTLY from client request - NO VALIDATION! webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader) if len(webAuthUser) > 0 { user, err := store.GetUserByUsername(ctx.Req.Context(), webAuthUser) if err != nil { if !database.IsErrUserNotExist(err) { log.Error("Failed to get user by name: %v", err) return nil, false, false } // Check if enabled auto-registration. if conf.Auth.EnableReverseProxyAutoRegistration { // Creates new user with forged username! user, err = store.CreateUser( ctx.Req.Context(), webAuthUser, gouuid.NewV4().String()+"@localhost", database.CreateUserOptions{ Activated: true, }, ) if err != nil { log.Error("Failed to create user %q: %v", webAuthUser, err) return nil, false, false } } } // Returns user as authenticated without any verification! return user, false, false } } // ... fallback to basic auth ... } // ... } The code has zero validation that: 1. The request came through a reverse proxy 2. The header was set by the proxy (not the client) 3. Gogs is actually behind a reverse proxy 4. The direct access to