Warpgate CVE-2026-91165

Exploitation requires the Warpgate SSO login flow configured with response_mode=form_post, and the injected value must reach the return page via either (a) an attacker-controlled next redirect parameter stored through sso_provider_detail.rs, or (b) IdP-derived error messages, which is only reachable when the attacker controls a configured identity provider OR controls the email/username claim on an attacker-controlled account and the IdP permits the required unvalidated claim format. A victim must actively complete the form_post SSO flow (UI:R) for the injected markup to render. Critically, Warpgate's Content-Security-Policy blocks injected JavaScript and event handlers, so exploitation cannot achieve script execution - impact is limited to content spoofing, a false login form, or a meta refresh. Fixed in 0.27.6; versions at or above are not affected.

This is a low-priority, high-friction issue despite being an XSS-class (CWE-79) finding. The vendor CVSS of 2.4 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) already reflects a heavily gated, low-integrity-only impact, and I concur it is minor. The decisive mitigating fact - stated in the description itself - is that Warpgate's Content-Security-Policy blocks the injected JavaScript and event handlers, so the demonstrated impact is NOT script execution but content spoofing (a false login form or a meta refresh). That reduces this from a classic account-takeover XSS to a phishing/UI-redress primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the intelligence, and the only exploit artifact is the vendor commit that fixes it. There is a signal tension worth flagging: the vendor assigned PR:H, but the description gives a plausible path (attacker-controlled next redirect parameter stored by sso_provider_detail.rs) that resembles the confirmed unauthenticated sibling CVE-2026-58491 (PR:N) - so the true privilege prerequisite may be lower than PR:H for one code path; verify with the vendor which path was scored. Exploitation status: no public exploit identified at time of analysis. Net: real but negligible risk, dominated by the CSP mitigation and the requirement that a victim complete an SSO flow.

An attacker crafts a malicious SSO return link (or controls an identity provider / a claim on an attacker-controlled account) so that a script-closing sequence is injected into the form_post return page's inline script block. A victim who follows the link and completes the form_post SSO flow is served a spoofed page - for example a fake Warpgate login form to harvest credentials or a meta refresh to an attacker site - though the CSP prevents actual JavaScript execution. No public POC exists beyond the fix commit; exploitation requires victim interaction and completing the SSO handshake.