An unauthenticated attacker can supply a backslash-containing URL to the /redirect endpoint in Gogs. Because the IsSameSite function normalizes the target differently than the Location header generation, browsers treat the target as a scheme-relative external address, which results in a redirect to attacker-controlled content. This creates an open-redirect flaw that can be used for phishing or social-engineering attacks. The weakness is identified as CWE-601.

Gogs self-hosted Git service, version 0.14.x and earlier (any release before 0.15.0+dev). The vulnerability is fixed in 0.15.0+dev and later releases. Only unauthenticated users can trigger the redirect, so any user accessing the service is at risk.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not a widely exploited target at this time. Despite this, the flaw is trivial to exploit—an attacker simply crafts a URL with a backslash to the vulnerable /redirect endpoint, or any process that triggers post-action redirects. The open redirect can be leveraged in phishing campaigns, and the impact can be significant if attackers spread malicious campaigns to users of the trusted Gogs domain.