# CVE-2026-44347: Warpgate SSO CSRF via state parameter validation failure

Source: https://junglewise.ai/threats/cve-2026-44347-warpgate-sso-csrf-via-state-parameter-validation-failure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44347 · Severity: medium · CVSS 5.8 · Published 2026-05-12

Warpgate is a gateway used to manage secure access to SSH, HTTPS, and database servers. A security flaw in its single sign-on (SSO) process allows an attacker to trick a legitimate user into logging into the attacker's account instead of their own. This could lead to users inadvertently performing sensitive actions on the attacker's systems or entering private credentials into malicious targets controlled by the attacker.

## Quick answers

**Is CVE-2026-44347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44347 being exploited in the wild.

**How severe is CVE-2026-44347?** Medium severity, with a CVSS score of 5.8, published 12 May 2026.

**Which products and versions are affected?** warp-tech Warpgate < 0.23.3.

**Is there a fix for CVE-2026-44347?** A patch was published on 2026-05-12: Fix released in version 0.23.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44347 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44347?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Warpgate's SSO implementation due to the failure to validate the 'state' parameter during the OAuth2/SSO return flow. While the application generates a CSRF token and stores it in the login request, the SSO return handler in 'sso_provider_list.rs' only consumes the authorization code without verifying the returned state against the stored token. An attacker can exploit this by forcing a victim's browser to complete an SSO handshake using the attacker's credentials. This 'Login CSRF' allows the attacker to control the session environment, potentially leading to credential harvesting if the victim interacts with malicious targets configured within the attacker's account. The issue is resolved in version 0.23.3.

## Affected products

- warp-tech Warpgate < 0.23.3

## Timeline

- 2026-04-29: advisory: GitHub Security Advisory published by maintainers
- 2026-05-12: disclosed: CVE-2026-44347 published to NVD
- 2026-05-12: patched: Fix released in version 0.23.3

## References

- [https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275](https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275)