Gophish API Authentication Middleware Bypass

Gophish versions through 0.12.1 contain a critical security flaw (CVE-2026-82269) within the application's API authentication middleware. The implementation fails to correctly enforce account security policies, specifically account lockout states and mandatory password rotation requirements, when authentication is performed via the API. This vulnerability allows an attacker who has acquired a valid API key to bypass these security constraints. Even if an administrator disables an account or mandates a password reset for compromised credentials, the API middleware continues to honor existing, valid API keys. This enables persistent access to sensitive data and Gophish operational controls despite intended account restrictions. Defenders should identify all active API keys in their environment and verify them against the status of the associated user accounts until the software can be patched to a version that properly integrates state checks into the API authentication logic.

Impact

Successful exploitation allows for unauthorized persistence and potential privilege escalation within a Gophish deployment. By bypassing lockout and password change requirements, an attacker can maintain long-term access to phishing campaign configurations, sensitive target data, and administrative API endpoints. This significantly lowers the barrier for attackers to maintain access after a primary credential compromise has been detected and mitigated by an administrator.

Recommendation

• Perform an audit of all active Gophish API keys and cross-reference them with currently active and compliant user accounts.
• Review Gophish API access logs to identify anomalous or unauthorized persistent connections.
• Upgrade Gophish to a version beyond 0.12.1 once the vendor provides a patch addressing CVE-2026-82269.
• Implement restrictive network access control lists (ACLs) to limit access to Gophish API endpoints to known, trusted management IP addresses.