Remember-Me token theft session persistence in Gitea (CVE-2026-56750)

Gitea's Remember-Me authentication fails to invalidate an attacker's session when a stolen token is detected as compromised via hash mismatch. When the legitimate user's original token triggers a hash mismatch, Gitea deletes the victim's local cookie but does not remove the attacker's rotated token from the database, leaving the attacker with persistent, indefinite access to the victim's account. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS ? · our assessment: act_now Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-rgv6-xp99-6mgj Details: https://vuln.today/cve/CVE-2026-56750