← Vulnerability feed

Vulnerability record · CVE-2023-48712 · published 24 November 2023

CVE-2023-48712: Warpgate project warpgate incorrect authorization vulnerability

Warpgate Project · Warpgate

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.

8.8 CVSS 3.1 High EPSS 0.68% · top 49.7% CWE-863 · Incorrect authorization
8.8CVSS 3.1 base score
0.68%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76 Patch
https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr Vendor Advisory
https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76 Patch
https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr Vendor Advisory

Track CVE-2023-48712 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-37268Warpgate project warpgate improper authentication vulnerabilityWarpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attac…EPSS 0.55%8.1CVE-2023-43660Warpgate project warpgate improper authentication vulnerabilityWarpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be byp…EPSS 0.25%7.5CVE-2026-42189Russh project russh allocation without limits vulnerabilityRussh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's key…EPSS 0.76%7.5CVE-2024-43410Russh project russh allocation without limits vulnerabilityRussh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH p…EPSS 0.91%6.5CVE-2026-44347Warpgate project warpgate cross-site request forgery vulnerabilityWarpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which ma…EPSS 0.16%6.5CVE-2025-54804Russh project russh integer overflow vulnerabilityRussh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the…EPSS 0.40%9.1CVE-2026-71362Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vul…KEVEPSS 88%8.8CVE-2026-42016JFrog Artifactory token scope bypass enables privilege escalationJFrog Artifactory (Self Hosted) before 7.133.11 validates a token's signature and issuer but not its scope, so a token can be used for actions beyond…KEVEPSS 8.6%analysed

Source: NIST National Vulnerability Database (record CVE-2023-48712), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.