Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck
CVE-2026-82269Gophish Account Lockout and Forced Password Change Bypassable via API Key
High 8.1
In plain English
A high-severity authentication bypass in gophish from gophish. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
Affected products (as reported)
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Issue #9440 issue-tracking
- https://github.com/gophish/gophish product
- Vulnerable code: middleware.go technical-description
- VulnCheck Advisory: Gophish Account Lockout and Forced Password Change Bypassable via API Key third-party-advisory