CVE-2026-82269 gophish CVE debrief

Who should care

Defenders responsible for Gophish deployments should assess exposure and verify API key usage. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that API key usage is properly monitored and controlled to prevent unauthorized access. Additionally, defenders should review compensating controls for exposed systems and track exceptions to ensure comprehensive risk management.

Why it matters

CVE-2026-82269 allows attackers with valid API keys to bypass account lockout and password change requirements, potentially leading to unauthorized API access.

• Verify API key usage and enforce account lockout policies
• Enforce password change requirements for API users
• Monitor API activity for suspicious behavior

Technical summary

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls, potentially leading to unauthorized API access. This vulnerability affects Gophish deployments, particularly those with API key usage. Defenders should assess exposure and verify API key usage to mitigate potential risks. The vulnerability class involves authentication middleware weaknesses, and source-grounded technical framing suggests that defenders prioritize verifying API key usage and enforcing account lockout policies.

Defensive priority

Defenders should prioritize verifying API key usage and enforcing account lockout and password change policies.

Recommended defensive actions

• Verify API key usage and enforce account lockout policies
• Enforce password change requirements for API users
• Monitor API activity for suspicious behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information on affected versions and remediation is required for comprehensive risk management. Defenders should verify API key usage and enforce account lockout policies. The vulnerability allows attackers with valid API keys to bypass account lockout and password change requirements, potentially leading to unauthorized API access. Evidence limits suggest that further verification is needed to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.