EUVD-2026-41613
GHSA-gx3v-q759-g323
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Attacker must capture a live TOTP code and replay it within its short window, so AC:H; no auth needed by attacker (PR:N) but victim must generate a code (UI:R), yielding account takeover (C:H, I:L).
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
AnalysisAI
TOTP two-factor authentication replay in Gitea 1.5.0 through 1.26.2 lets a captured valid one-time code be accepted multiple times instead of being invalidated after first use, weakening 2FA on both the web login flow and the Basic Auth X-Gitea-OTP header path. An attacker who observes a legitimate TOTP code (via interception, shoulder-surfing, or logging) can replay it within its validity window to authenticate as the victim. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is fixed in Gitea 1.26.3.
Technical ContextAI
Gitea is a self-hosted, open-source Git service (a lightweight GitHub/GitLab alternative) written in Go. The affected component is its time-based one-time password (TOTP, RFC 6238) second-factor implementation. TOTP codes are meant to be single-use: once a code is consumed for authentication it must be marked as spent so it cannot be presented again during the ~30-second window in which it remains cryptographically valid. This CVE maps to CWE-294 (Authentication Bypass by Capture-replay): Gitea failed to record and reject already-used codes consistently, so the same code passed validation more than once. The defect spans two distinct entry points - the interactive web 2FA flow and the programmatic Basic Auth path that reads the code from the X-Gitea-OTP HTTP header - indicating the missing single-use enforcement was in shared verification logic rather than a single UI handler. The single affected CPE is cpe:2.3:a:gitea:gitea_open_source_git_server.
RemediationAI
Vendor-released patch: upgrade to Gitea 1.26.3 (or the later 1.26.4) per the vendor advisory GHSA-gx3v-q759-g323 and release notes at https://blog.gitea.com/release-of-1.26.3-and-1.26.4/; the code fix is in pull request https://github.com/go-gitea/gitea/pull/38151. As the primary and definitive fix, upgrade the Gitea binary/container to 1.26.3+ following the standard upgrade procedure. If immediate patching is not possible, compensating controls include restricting network exposure of the Gitea instance to trusted networks or VPN to limit who can present a replayed code, terminating TLS correctly and enforcing HTTPS everywhere to reduce opportunities to capture codes in transit (trade-off: does not stop capture at the endpoint or via logs), and - for high-value accounts - temporarily disabling the Basic Auth X-Gitea-OTP path or programmatic access if not required (trade-off: breaks CI/CD or scripted clients that rely on it). These are stopgaps only; the code reuse defect is closed only by the upgrade.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today