CVE-2025-64175
High · 8.8CVSS
8.8
EPSS
0.5%
Published
Feb 6, 2026
CISA due date
—
The record
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code (e.g., from their own account) to bypass the victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where it's enabled.. This issue has been patched in versions 0.13.4 and 0.14.0+dev.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | gogs.io/gogs | 0.11.19 | No fix |
| Go | gogs.io/gogs | 0.11.19 | 0.13.4 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4449 Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs Same vulnerability
- GO-2026-4501 Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs Also affects gogs.io/gogs
- GO-2026-4498 Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs Also affects gogs.io/gogs
- GO-2026-4499 Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in… Also affects gogs.io/gogs
- GO-2026-4500 Unauthenticated File Upload in Gogs in gogs.io/gogs Also affects gogs.io/gogs
- CVE-2026-25232 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- CVE-2026-25242 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- CVE-2026-25229 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs