Warpgate versions prior to 0.25.5 contain a cross-site scripting vulnerability due to improper HTML escaping of an attacker-controlled 'next' parameter in the /@warpgate/api/sso/providers/:name/start and /@warpgate/api/sso/return endpoints. When a victim follows a crafted link and completes single sign-on (SSO), malicious markup and JavaScript can execute within the authenticated Warpgate origin. This allows attackers to access session data and invoke user APIs, and if the victim is an administrator, also administrator APIs. The GET /@warpgate/api/sso/return endpoint also uses the unvalidated 'next' parameter as a redirect destination, resulting in an open redirect vulnerability. The vulnerability is addressed and fixed in Warpgate version 0.25.5.

Successful exploitation allows execution of arbitrary JavaScript in the context of the authenticated Warpgate origin, leading to potential theft of session data and unauthorized actions via user APIs. If the victim is an administrator, attacker access extends to administrator APIs. The open redirect vulnerability can facilitate phishing or redirect users to malicious sites. The CVSS 3.1 score is 9.3 (critical), reflecting high impact on confidentiality and integrity with no availability impact.

Upgrade Warpgate to version 0.25.5 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in 0.25.5.