CVE-2025-64175 - CVE House
Back to Database
Status published High CVE-2025-64175

Gogs Vulnerable to 2FA Bypass via Recovery Code

Vulnerability Description

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code (e.g., from their own account) to bypass the victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where it's enabled.. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64175

Credits & Attribution

No credits recorded in the NVD database.

References

More from gogs

View All →
CVE-2025-64719
Gogs: Denial of Service in repository/wiki file listing web pages
Medium 4.9
CVE-2025-64111
Gogs's update .git/config file allows remote command execution
Critical 9.3
CVE-2025-47943
Gogs stored XSS in PDF renderer
Medium 6.3
CVE-2024-56731
Gogs deletion of internal files allows remote command execution
Critical 10
CVE-2024-55947
Gogs has a Path Traversal in file update API
High 8.7

Affected Vendor

Affected Software

gogs
Vulnerable Versions:
< 0.14.0+dev, < 0.13.4

Timeline

Official Publish: February 6th, 2026
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access