{"id":27250,"date":"2026-09-22T04:30:47","date_gmt":"2026-09-21T20:30:47","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-91165"},"modified":"2026-09-22T04:30:47","modified_gmt":"2026-09-21T20:30:47","slug":"cve-2026-91165","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-91165","title":{"rendered":"CVE-2026-91165 [LOW] &#8211; Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, t"},"content":{"rendered":"<p>Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http\/src\/api\/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http\/src\/api\/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http\/src\/api\/sso_provider_list.rs uses serde_j<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-27250","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/27250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=27250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=27250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=27250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}