CVE-2025-64175: Gogs Vulnerable to 2FA Bypass via Recovery Code

February 6, 2026

Contact OpenAI Security Research at outbounddisclosures@openai.com to engage on this report. See PDF report for easier reading.

References

github.com/advisories/GHSA-p6x6-9mx6-26wj
github.com/gogs/gogs
github.com/gogs/gogs/commit/a617d52374e937db0edacfba2a26bdd14a05538e
github.com/gogs/gogs/commit/d568e048315dc9729c8518d8085cab7dbbfac80f
github.com/gogs/gogs/security/advisories/GHSA-p6x6-9mx6-26wj
nvd.nist.gov/vuln/detail/CVE-2025-64175

Code Behaviors & Features

Detect and mitigate CVE-2025-64175 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →