Gitea EUVD-2026-58145

Exploitation requires the attacker to first obtain a valid victim Remember-Me (gitea_incredible) cookie out-of-band - via XSS, TLS/network interception, malware, or local/physical access to the victim's browser - and the Remember-Me feature must be in use on the target instance. Once a stolen token is replayed against POST /user/login (or any endpoint invoking autoSignIn), the attack succeeds because Gitea fails to delete the compromised token on hash-mismatch detection. Limiting factors: this is not a standalone remote-unauthenticated code path - the token theft is the hard prerequisite; instances that disable Remember-Me are not exploitable, and enforced TLS materially raises the difficulty of the required token capture. No user interaction by the victim is needed for the attacker to retain access.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, base 9.1) treats this as a trivial network attack, but that rating understates a critical precondition: the attacker must already possess the victim's Remember-Me cookie, obtained out-of-band via XSS, network interception, malware, or physical/local access. That prerequisite is what makes real-world likelihood far lower than the 9.1 suggests, and it is consistent with the low EPSS score of 0.16% (5th percentile). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is exploited-conditionally rather than mass-exploitable. Where the score is fully justified is impact and persistence: once a token is stolen, this flaw removes the one automatic mechanism that would have evicted the attacker, converting a transient token theft into indefinite account control - so any operator whose users authenticate over untrusted networks or who has ever had a token-exposure incident should treat patching as urgent rather than routine. In short, high impact and high persistence, but gated by a meaningful precondition; prioritize based on your exposure to token theft, not on the 9.1 alone.

An attacker who captures a victim's Gitea Remember-Me cookie (for example via a network intercept on an unencrypted or downgraded connection, or a shared/compromised workstation) replays it to autoSignIn and receives a freshly rotated token for the same ID. When the victim next uses their original cookie, Gitea detects the hash mismatch and logs the victim out locally but leaves the attacker's rotated token active in the database, so the attacker retains persistent access to the account and its repositories indefinitely. No public exploit code has been identified, and success depends on first obtaining a valid token out-of-band.