CyberRota Analysis
AI-GeneratedGophish versions up to 0.12.1 are vulnerable due to inadequate enforcement of account lockout and password change requirements in the API authentication middleware. This flaw allows attackers with valid API keys to maintain unrestricted access to the API, even if their accounts should be locked or require a password update. Organizations utilizing Gophish for phishing simulations and related activities should prioritize immediate remediation to mitigate potential unauthorized access risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.