EUVD-2026-41628
GHSA-5v69-g2m3-3hq3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network vector but AC:H because the attacker must first capture a valid, TLS-protected authorization code; no privileges needed to replay it, yielding high confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
AnalysisAI
Authentication bypass via OAuth2 authorization code replay in Gitea before 1.25.5, where the server fails to consistently enforce code expiry and single-use during the token-exchange step, letting an attacker who obtains a valid authorization code redeem it (potentially more than once, and after it should have expired) to mint access tokens for a victim's account. The source fix confirms authorization codes previously had no enforced 10-minute validity window and that double-redemption was not reliably detected. EPSS is low (0.17%, 6th percentile) and CISA SSVC lists exploitation status as none, but SSVC rates the technical impact as total and marks it automatable; no public exploit identified at time of analysis.
Technical ContextAI
The flaw lives in Gitea's built-in OAuth2 authorization-code provider (models/auth/oauth2.go and routers/web/auth/oauth2_provider.go). In the OAuth2 authorization-code grant (RFC 6749 §4.1.2), the authorization code is a short-lived, one-time bearer credential exchanged at the token endpoint for an access token. CWE-294 (Authentication Bypass by Capture-replay) is the root-cause class: Gitea did not stamp codes with an expiry (ValidUntil) and did not treat a code as consumed once used, so a captured code remained valid indefinitely and could be replayed. The patch introduces oauth2AuthorizationCodeValidity = 10 minutes, an IsExpired() check that rejects and invalidates stale codes, and changes Invalidate() to inspect the affected-row count so a second redemption returns ErrOAuth2AuthorizationCodeInvalidated (invalid_grant). The single affected CPE is cpe:2.3:a:gitea:gitea_open_source_git_server, a self-hosted Go-based Git service.
RemediationAI
Vendor-released patch: upgrade to Gitea 1.25.5 or later, which enforces a 10-minute authorization-code validity window and reliable single-use invalidation (fixes in https://github.com/go-gitea/gitea/pull/36797 and https://github.com/go-gitea/gitea/pull/36851; release https://github.com/go-gitea/gitea/releases/tag/v1.25.5, notes https://blog.gitea.com/release-of-1.25.5/). If you cannot upgrade immediately, reduce exposure of authorization codes: ensure all OAuth2 clients use exact-match HTTPS redirect URIs and PKCE so intercepted codes are harder to redeem, review and rotate any OAuth2 client secrets, and audit access logs/token grants for suspicious repeated code exchanges - noting these controls lower but do not eliminate replay risk. As a stronger interim measure, disable or restrict Gitea's OAuth2 provider for untrusted third-party applications until the upgrade is applied, accepting that this breaks dependent SSO/integrations. Confirm the fix by verifying the running build reports version 1.25.5+.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today