CVE-2023-49947

HIGH

Forgejo < 1.20.5-1 - Two-Factor Authentication Bypass via Docker Login Basic Authentication

Title source: llm

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.

Core 2

Core References

Patch

Release Notes, Vendor Advisory

CVSS v3 7.5

EPSS 0.0061

EPSS Percentile 44.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-863

Status published

Products (1)

forgejo/forgejo < 1.20.5-1

Published Dec 03, 2023

Tracked Since Feb 18, 2026