Gogs – Authentication Bypass via Unvalidated Reverse Proxy Headers

When ‘ENABLE_REVERSE_PROXY_AUTHENTICATION’ is enabled, Gogs accepts the configured authentication header (default: ‘X-WEBAUTH-USER’) directly from client requests without validating that the request originated from a trusted reverse proxy.

Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication.