CVE•Published 2026-06-24•Modified 2026-06-26•0 articles on news•6 live references•NVD data

CVE-2026-52809

Vulnerability data via NVD (ingested)

CVSS v3.1

6.8

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS percentile

Exploit Prediction Scoring System · top 90% of all CVEs

Weaknesses (CWE)

CWE-324Use of a Key Past its Expiration Date CWE-613Insufficient Session Expiration

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), not conf.Auth.ResetPasswordCodeLives. The token lifetime is baked into the token itself at generation time and is re-extracted from the token at verification time, making RESET_PASSWORD_CODE_LIVES irrelevant to actual enforcement. When an administrator configures a shorter reset window (e.g., 10 minutes) for compliance or security reasons, reset tokens remain exploitable for the full activation lifetime instead, while the reset email falsely advertises the shorter expiry. This vulnerability is fixed in 0.14.3.

Timeline

Published 2026-06-24

Modified 2026-06-26

External references

NVD MITRE Exploit-DB GitHub PoC trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-52809

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-52809

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-52809

Censys host search filtered to this CVE id.

grep.app

CVE-2026-52809