A client can supply a forged x-warpgate-username or x-warpgate-authentication-type header that the proxy forwards to the backend before its own authenticated user header is added. Because the request builder preserves repeated header values, a backend that trusts the first value can authenticate the attacker as any user. This flaw allows an attacker who can send a request through Warpgate to impersonate other users on the target backend service, undermining confidentiality of user data and potentially enabling further compromise.

Warp‑Tech Warpgate software versions earlier than 0.25.6 are affected. The vulnerability exists in the copy_server_request handler in warpgate-protocol-http and is fixed in release 0.25.6 and later.

The CVSS score is 4.9, indicating a moderate severity. No EPSS data is available and the vulnerability has not been listed in CISA’s KEV catalog. The likely attack vector is an authenticated user who can inject the spoofed headers into a forwarded request; no additional preconditions beyond a valid session to Warpgate are required. Attackers can then exploit backend trust of those headers to acquire unauthorized access.