CVE-2026-52809

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description Password-reset tokens are generated using the account-activation lifetime conf.Auth.ActivateCodeLives instead of the intended password-reset lifetime conf.Auth.ResetPasswordCodeLives. Because the token lifetime is embedded into the token during generation and re-extracted during verification, the RESET PASSWORD CODE LIVES configuration is ignored during enforcement. This results in reset tokens remaining valid for the full activation lifetime even if an administrator has configured a shorter reset window for security reasons, while the reset email incorrectly informs the user of the shorter expiry. An attacker who intercepts a reset token can exploit this extended window to perform an account takeover. The issue involves the GenerateActivateCode() function, the SendResetPasswordMail() function, and the verifyUserActiveCode() and ResetPasswdPost() functions. The affected API endpoints include '/user/forget password' and '/user/reset password'.

Recommendations Update Gogs to version 0.14.3. As a temporary workaround, ensure that ACTIVATE CODE LIVES is set to a value that meets your security requirements for password resets, as this value currently governs the actual expiration of reset tokens.