EUVD-2026-41629
GHSA-m5ch-ppfx-xv3v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated (PR:N/AV:N), but realistic exploitation requires intercepting a victim's authorization code, so AC:H; account takeover yields C:H/I:H, no availability impact.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
AnalysisAI
OAuth2 PKCE protection bypass in Gitea before 1.25.5 allows remote attackers to complete an authorization-code token exchange without a valid code verifier because the server fails to persist the S256 challenge method during authorization. Rated CVSS 9.1 with SSVC technical impact of 'total', though EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis. The fix is confirmed in release v1.25.5 (PRs 36462 and 36477), which was reported by the Gitea project itself.
Technical ContextAI
Gitea is a self-hosted, lightweight open-source Git service written in Go that includes a built-in OAuth2/OpenID Connect provider (identified by CPE cpe:2.3:a:gitea:gitea_open_source_git_server). PKCE (Proof Key for Code Exchange, RFC 7636) hardens the OAuth2 authorization-code flow - especially for public clients - by binding the issued authorization code to a code_challenge, so the code cannot be redeemed without the matching code_verifier. The source evidence shows the root cause is a Go switch statement in routers/web/auth/oauth2_provider.go where 'case "S256":' and 'case "plain":' were written as separate empty cases; because Go cases do not fall through, the S256 challenge method was never properly recorded/persisted, so at token-exchange time the server did not enforce the verifier check. The fix collapses them into a single 'case "S256", "plain":'. The CWE-284 (Improper Access Control) classification reflects that a required authorization check (the PKCE verifier validation) was effectively skipped.
RemediationAI
Upgrade to Gitea 1.25.5 or later - this is the vendor-released patch (see the release at https://github.com/go-gitea/gitea/releases/tag/v1.25.5 and release notes at https://blog.gitea.com/release-of-1.25.5/; code fixes in https://github.com/go-gitea/gitea/pull/36462 and https://github.com/go-gitea/gitea/pull/36477). There is no configuration-level fix for the PKCE persistence bug itself, so patching is the primary and recommended remediation. As interim compensating controls if you cannot upgrade immediately: restrict which OAuth2 applications are registered on the instance and audit/remove untrusted registered clients (trade-off: administrative overhead and possible disruption to legitimate integrations), tightly constrain each OAuth application's allowed redirect URIs to exact, trusted values to limit authorization-code leakage (trade-off: breaks clients relying on loose redirect matching), and place the Gitea OAuth2 provider endpoints behind network restrictions or a reverse proxy limited to trusted networks where feasible (trade-off: may block legitimate external SSO consumers). Rotating client secrets after upgrade is also advisable if you suspect exposure.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today