Warpgate versions before 0.27.6 have an XSS vulnerability in the SSO return path when response_mode=form_post is used. The vulnerability arises because the code uses serde_json::to_string without properly neutralizing script-closing sequences in attacker-controlled input parameters, such as the next redirect parameter or IdP-derived error messages. An attacker controlling an identity provider or certain claims can inject markup that is rendered when a victim completes the form_post SSO flow. The Content-Security-Policy blocks JavaScript execution, limiting impact to content spoofing rather than script execution. The issue is resolved in version 0.27.6.

The vulnerability does not allow script execution due to Content-Security-Policy restrictions but can be exploited to spoof content, such as displaying false login forms or triggering meta refresh redirects. This could potentially mislead users but does not compromise confidentiality or availability. The CVSS score is 2.4 (low severity), reflecting limited impact.

Upgrade warpgate to version 0.27.6 or later, where this vulnerability is fixed. No other mitigations are specifically required as the Content-Security-Policy already blocks script execution and event handlers.