CVE-2026-20896 Gitea Docker X-WEBAUTH-USER Admin Header Injection

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects unauthorized HTTP requests to Gitea containing an 'X-WEBAUTH-USER' header set to 'admin'. This targets CVE-2026-20896, where a misconfigured reverse proxy trust setting allows external users to spoof authentication and gain administrative privileges.