CVE-2026-58491

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.5

Description The software fails to properly escape the next parameter stored via the '/@warpgate/api/sso/providers/:name/start' endpoint. This value is subsequently inserted without HTML escaping into the response by the 'POST /@warpgate/api/sso/return' handler. An attacker can use a crafted link to execute arbitrary markup and JavaScript within the authenticated origin, potentially granting access to session data and user or administrator APIs. Additionally, the 'GET /@warpgate/api/sso/return' path uses this unvalidated value as a redirect destination, which allows for an open redirect.

Recommendations Update to version 0.25.5.