I experienced the same issue with exactly the same package versions. Downgrading only greenbone-security-assistant to the previously working version, 26.17.0-0kali1, restored successful login.

As root, I ran:

mkdir -p /root/gsa-rollback
cd /root/gsa-rollback

wget https://ftp.luis.uni-hannover.de/kali/pool/non-free/g/greenbone-security-assistant/greenbone-security-assistant_26.17.0-0kali1_all.deb

apt install --allow-downgrades ./greenbone-security-assistant_26.17.0-0kali1_all.deb

apt-mark hold greenbone-security-assistant
systemctl restart gsad

Then I opened the web interface in a private browser window to avoid cached frontend assets. Authentication and normal operation worked again, without changing the database or credentials.

The hold prevents subsequent upgrades from immediately reinstalling the affected version. Once compatible packages are available, it can be removed with:

apt-mark unhold greenbone-security-assistant

This is a temporary workaround pending a packaging fix.

Upstream release notes for GSA 28.0.0 state “Requires gsad >= 27.0.0”:
https://github.com/greenbone/gsa/releases

The same issue also for me. update of the greenbone-security-assistant package to version 28.3.0-0kali1 causes issues with accessing the web interface, resulting in an “unable to connect to server” error. Downgrading to version 26.17.0-0kali1 restores normal functionality; therefore, there is an issue with the 28.3.0-0kali1 package that requires a fix. Best regards.

greenbone-security-assistant 28.3.0-0kali1 allows an incompatible gsad version, causing login to fail with HTTP 404

Summary

Upgrading greenbone-security-assistant from 26.17.0-0kali1 to 28.3.0-0kali1 breaks web login when the installed server reports gsad 24.16.0~git.

The newer frontend uses POST /login, which this older gsad does not implement. The request returns HTTP 404, displayed as “Could not connect to server.”

The frontend package does not declare a minimum gsad version, allowing this incompatible combination.

Environment

Installation method: Kali Linux packages

Working frontend: greenbone-security-assistant 26.17.0-0kali1

Failing frontend: greenbone-security-assistant 28.3.0-0kali1

Server runtime version: gsad 24.16.0~git

Manager socket: /run/gvmd/gvmd.sock

gsad process user/group: _gvm:_gvm

Steps to reproduce

Run gsad 24.16.0 with a working gvmd connection and valid credentials.

Confirm web login works with greenbone-security-assistant 26.17.0-0kali1.

Install greenbone-security-assistant 28.3.0-0kali1, retaining the same gsad version.

Load the updated frontend and attempt to sign in.

Inspect the browser’s network requests.

Actual result

The UI displays “Could not connect to server.”

Observed responses:

Request

Status

POST /login

404

GET /gmp?cmd=get_settings

401

The unauthorized response contains:

<message>Token missing or bad. Please login again.</message>

A response also sets GSAD_SID=0, clearing the session cookie.

Using frontend version 26.17.0-0kali1 restores working login.

Expected result

Installing or upgrading the frontend should enforce compatibility with a locally installed gsad. An incompatible combination should require a server upgrade or be rejected by the package manager.

Diagnostics

gvmd is listening on its socket, and communication as _gvm succeeds:

sudo -u _gvm gvm-cli socket \
--socketpath /run/gvmd/gvmd.sock \
--xml '<get_version/>'

After entering the credentials:

<get_version_response status="200" status_text="OK"><version>22.7</version></get_version_response>

Here, 22.7 is the GMP protocol version.

Source analysis

Both Kali source packages were downloaded, their archive SHA-256 checksums verified against their .dsc files, and their authentication code and packaging compared.

Login endpoint changed

In src/gmp/commands/login.ts:

26.17.0: sends credentials to /gmp with cmd=login.

28.3.0: sends credentials directly to /login.

The change is in GSA commit 7b7514e. Its commit message explicitly requires the server changes in gsad PR 0000403.

In gsad 24.16.0, src/gsad_http_handle_request.c has no POST authentication handler for /login; unmatched POST requests return 404. The frontend maps this status to the displayed connection error.

Additional compatibility requirement

The newer frontend also expects session duration information rather than the older absolute session-expiry timestamp.

The GSA 28.0.0 release notes explicitly require gsad >= 27.0.0.

Missing package relationship

In both Kali source versions, debian/control declares:

Depends: ${misc:Depends}

There is no versioned dependency or incompatibility declaration covering gsad.

Suggested fix

Add an appropriate versioned package relationship enforcing compatibility with gsad >= 27.0.0 for GSA 28.x.

Depending on whether the frontend package is intended to support installations without a local gsad, this could be a versioned dependency or a Breaks relationship against older gsad packages.

Workaround

Keep greenbone-security-assistant 26.17.0-0kali1 with the existing server, or upgrade gsad and its required dependencies to versions compatible with GSA 28.3.0.