CVE-2026-91165 in Warpgate
Summary
by MITRE • 09/21/2026
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
Warpgate serves as an open-source bastion host supporting SSH, HTTPS, and MySQL protocols for Linux environments, acting as a critical security gateway that mediates access to backend infrastructure. Within this architecture, the Single Sign-On (SSO) functionality relies on specific response modes to handle authentication flows between identity providers and the Warpgate service. A significant vulnerability was identified in versions prior to 0.27.6 regarding the handling of SSO return paths when utilizing the form_post response mode. This flaw resides within the warpgate-protocol-http component, specifically affecting the sso_provider_list.rs module where the ReturnToSsoPostResponse structure is processed. The core technical deficiency involves the use of serde_json::to_string for serializing responses without adequately neutralizing script-closing sequences such as </script>. This lack of proper escaping allows attacker-controlled data to break out of its intended context and inject arbitrary markup into the HTML response stream.
The injection vector operates through two primary pathways, both leveraging insufficient input validation during URL construction or parameter handling. The first pathway involves an attacker-controlled next redirect parameter stored in sso_provider_detail.rs, which is subsequently used without proper encoding when constructing the return URL. The second pathway exploits IdP-derived error messages that are concatenated into make_redirect_url without adequate URL encoding. This specific vector becomes exploitable under conditions where the attacker controls a configured identity provider or possesses an account with manipulated email or username claims that bypass validation checks within the permitted claim format of the identity provider. Consequently, when these malicious inputs are processed during the SSO flow, they result in malformed HTML structures containing injected content rather than clean authentication responses.
The operational impact of this vulnerability is constrained by existing security controls but remains significant for integrity-based attacks. Warpgate implements a Content-Security-Policy header that effectively blocks the execution of any injected JavaScript code and event handlers. Therefore, while an attacker cannot achieve remote code execution or traditional cross-site scripting (XSS) leading to session hijacking via script injection, they can successfully perform content spoofing. This capability allows for the creation of false login forms designed to harvest credentials through phishing techniques or the implementation of meta refresh tags that redirect users to malicious external sites without their explicit consent. These attacks exploit the trust relationship between the user and the bastion host interface, potentially leading to credential theft or unauthorized redirections even if direct script execution is prevented by the CSP policy.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Although the impact is limited due to mitigating controls like Content-Security-Policy, the underlying flaw remains an injection issue where untrusted data is treated as executable content or structural markup. In terms of adversary tactics, this vulnerability supports ATT&CK technique T1059, Command and Scripting Interpreter, specifically in contexts where script execution might be attempted if CSP policies are misconfigured or bypassed in other deployments. It also relates to T1621, Multi-Factor Authentication Interception, as the false login forms can mimic multi-factor authentication prompts to steal additional credentials.
To mitigate this risk and prevent similar vulnerabilities in future implementations, it is essential to ensure that all dynamic content inserted into HTML contexts undergoes rigorous encoding appropriate for the specific context, such as HTML entity encoding or JavaScript string escaping. Developers should avoid using generic JSON serialization methods like serde_json::to_string when constructing parts of an HTML document unless strict validation and neutralization rules are applied to prevent breaking out of script tags or attribute values. Upgrading Warpgate to version 0.27.6 or later is the primary remediation step, as this release addresses the specific encoding deficiencies in the SSO return path handling. Additionally, organizations should review their identity provider configurations to ensure that claims are validated against expected formats and lengths, preventing attackers from injecting malicious payloads through manipulated user attributes. Regular security audits of authentication flows and continuous monitoring for anomalous redirect patterns can further enhance resilience against such integrity-based attacks.