Gitea EUVD-2026-41628

Exploitation requires the attacker to first obtain a valid OAuth2 authorization code issued by a vulnerable Gitea (before 1.25.5) acting as an OAuth2 provider - codes could be redeemed after their intended lifetime and/or reused more than once because expiry and single-use were not enforced at token exchange. Limiting factors: the target Gitea instance must have the OAuth2 authorization-code provider in use with at least one registered client; the attacker must capture a code that would otherwise be protected in transit by TLS and bound to a registered redirect URI (obtained via header/log leakage, an open redirect, a malicious/compromised client, or interception); and the enlarged window is bounded - the code is not literally eternal in all paths but the missing checks remove the intended short expiry and one-time guarantee. This is not remote-unauthenticated-against-default-config exploitation because a captured code is a prerequisite.

The signals conflict and should be weighed rather than taken at face value. The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H) and SSVC 'technical impact: total, automatable: yes' argue for high severity because a successful replay yields full account/token access with no privileges. However, EPSS is only 0.17% (6th percentile) and CISA SSVC exploitation status is 'none' - there is no evidence of active exploitation and no public PoC identified. Crucially, the CVSS AC:L rating understates the real precondition: an attacker must first OBTAIN a valid authorization code, which normally traverses TLS and a registered redirect URI, so capture typically requires code leakage (referer headers, logs, open redirects, a malicious/compromised client, or network interception). Once a code is captured, the missing expiry and single-use checks make redemption trivial and reliable, so this is a genuine defense-in-depth gap worth patching promptly, but it is not a mass, internet-scannable RCE. Treat as an important patch for internet-facing Gitea acting as an OAuth2/SSO identity provider, prioritized below actively-exploited KEV items.

An attacker obtains a victim's OAuth2 authorization code - for example via a leaked Referer header, server or proxy logs, or a partially-compromised OAuth client - and, because Gitea does not reliably expire or invalidate the code, replays it against the token endpoint to obtain a valid access token for the victim's Gitea account, gaining read/write access to that user's repositories and data. The high technical impact and 'automatable' SSVC rating mean redemption can be scripted once a code is captured; no public exploit code is currently identified.