Warpgate is an open source bastion host that provides SSH, HTTPS and MySQL access for Linux. Prior to version 0.25.6, the WebSocket endpoint used for live recording streams (/@warpgate/admin/api/recordings/{uuid}/stream) omitted the required admin permission check for AdminPermission::RecordingsView. The API was therefore protected only by session authentication, meaning any authenticated user could subscribe to an active recording and view the full terminal session. This exposed real‑time terminal input and output, including credentials, commands, and other sensitive data belonging to users and administrators. The vulnerability is rated 7.7 on the CVSS scale, indicating moderate‑high risk, and is listed as a missing authorization weakness (CWE‑285, CWE‑862).

The vulnerability applies to the warp-tech:warpgate product named Warpgate. All releases before 0.25.6 are affected, regardless of patch level. Users operating versions older than 0.25.6 on Linux systems should verify the exact version and schedule a patch.

The flaw can be exploited by any authenticated user, requiring only valid credentials to access other users’ or administrators’ recording streams. Because the attack vector depends solely on owning a legitimate account, it is most likely to be used by an insider or an attacker who has compromised credentials. The lack of an EPSS score and the fact that the issue is not listed in CISA KEV do not diminish the severity; the moderate‑high CVSS score combined with the broad reach of the flaw means that a successful exploitation could leak sensitive credentials and commands. Once a user has legitimate access, the restriction is purely temporal, as the attacker can repeatedly capture streams until the recording ends.