Executive brief
Warpgate is a gateway used to manage secure access to SSH, HTTPS, and database servers. A security flaw in its single sign-on (SSO) process allows an attacker to trick a legitimate user into logging into the attacker's account instead of their own. This could lead to users inadvertently performing sensitive actions on the attacker's systems or entering private credentials into malicious targets controlled by the attacker.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Warpgate's SSO implementation due to the failure to validate the 'state' parameter during the OAuth2/SSO return flow. While the application generates a CSRF token and stores it in the login request, the SSO return handler in 'sso_provider_list.rs' only consumes the authorization code without verifying the returned state against the stored token. An attacker can exploit this by forcing a victim's browser to complete an SSO handshake using the attacker's credentials. This 'Login CSRF' allows the attacker to control the session environment, potentially leading to credential harvesting if the victim interacts with malicious targets configured within the attacker's account. The issue is resolved in version 0.23.3.
Affected products
- warp-tech Warpgate < 0.23.3
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published by maintainers
- 2026-05-12: disclosed: CVE-2026-44347 published to NVD
- 2026-05-12: patched: Fix released in version 0.23.3