CVE-2026-91165

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.27.6

Description The SSO return path using response mode=form post in the warpgate-protocol-http/src/api/sso provider list.rs file fails to neutralize script-closing sequences when using serde json::to string inside ReturnToSsoPostResponse(). This allows an attacker to inject markup through the next redirect parameter or via IdP-derived error messages that are concatenated without URL encoding by make redirect url(). The IdP-derived path is accessible if the attacker controls a configured identity provider or the email/username claim on an account where the provider allows unvalidated claim formats. While the Content-Security-Policy blocks JavaScript and event handlers, the issue can be used for content spoofing, creating false login forms, or triggering meta refreshes. A victim must complete the form post SSO flow for the injection to occur.

Recommendations Update to version 0.27.6.