CVE-2025-64175

Gogs Vulnerable to 2FA Bypass via Recovery Code

High7.7EPSS 0.47%

Published: 6 Feb 2026
Updated: 26 Feb 2026
Reserved: 28 Oct 2025
Assigned by: GitHub_M

Description

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code (e.g., from their own account) to bypass the victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where it's enabled.. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Scores

CVSS scores of CVE-2025-64175, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	High7.7	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	High7.7	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.47% · top 59% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.

Weakness

CWE-287: Improper Authentication (opens in a new tab)All about CWE-287 and its CVEs

Affected products

gogs · gogs
- affected < 0.14.0+dev
- affected < 0.13.4

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Gogogs.io/gogsGHSA-p6x6-9mx6-26wj (opens in a new tab)

References (1)

https://github.com/gogs/gogs/security/advisories/GHSA-p6x6-9mx6-26wj (opens in a new tab)x_refsource_CONFIRMexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-64175](https://trackcve.app/badge/CVE-2025-64175.svg)](https://trackcve.app/cve/CVE-2025-64175)

Record last updated 26 Feb 2026, 15:04 UTC.