CVE-2023-43660

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-287
• CWE-347

• https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63Patch
• https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8Vendor Advisory
• https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63Patch
• https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8Vendor Advisory

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43655Composer is a dependency manager for PHP. Users publishing a…8.8
• CVE-2023-43656matrix-hookshot is a Matrix bot for connecting to external s…9
• CVE-2023-43657discourse-encrypt is a plugin that provides a secure communi…6.1
• CVE-2023-43658dicourse-calendar is a plugin for the Discourse messaging pl…6.1
• CVE-2023-43659Discourse is an open source platform for community discussio…5.4
• CVE-2023-4366Use after free in Extensions in Google Chrome prior to 116.0…8.8
• CVE-2023-43661Cachet, the open-source status page system. Prior to the 2.4…8.8
• CVE-2023-43662ShokoServer is a media server which specializes in organizin…8.6
• CVE-2023-43663PrestaShop is an Open Source e-commerce web application. In …4.3
• CVE-2023-43664PrestaShop is an Open Source e-commerce web application. In …4.3
• CVE-2023-43665In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 befo…7.5
• CVE-2023-43666Insufficient Verification of Data Authenticity vulnerability…6.5