Gitea CVE-2026-20896 X-WEBAUTH-USER Admin Impersonation via Spoofed Header
This rule monitors web traffic logs for requests targeting administrative URI paths or containing the username 'admin' in the 'X-WEBAUTH-USER' header. It specifically filters out requests originating from trusted reverse proxies, identifying potential attempts to bypass authentication by manually injecting administrative headers.
Splunk (SPL)
