Executive brief
Gogs is an open-source self-hosted Git service used by developers to manage source code. A flaw in the password reset system allows reset links to remain active for much longer than intended, even if an administrator has configured a short expiration window for security. If an attacker intercepts a reset link (for example, through a shared or compromised email account), they could take over a user's account and access private source code long after the link was supposed to expire.
Technical details
In Gogs versions prior to 0.14.3, password-reset tokens are generated using the 'ActivateCodeLives' configuration value instead of 'ResetPasswordCodeLives'. The vulnerability stems from the fact that the token's lifetime is hardcoded into the token string itself at generation time and re-extracted during verification, rendering the specific password-reset expiration setting irrelevant. While the reset email may falsely claim a short expiry (e.g., 10 minutes), the token remains cryptographically valid for the duration of the account activation window (often hours or days). An attacker who obtains a reset token can perform an account takeover even after the intended expiration window has passed. This issue is fixed in version 0.14.3.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-07: patched: Version 0.14.3 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD