CVE-2026-26232
CRITICALGitea OAuth2 authorization codes lack expiry and reuse enforcement
Title source: cnaDescription
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
References (4)
Core 4
Core References
Release Notes release-notes
Gitea v1.25.5 Release
https://github.com/go-gitea/gitea/releases/tag/v1.25.5
Release Notes release-notes
Gitea v1.25.5 Release Blog Post
https://blog.gitea.com/release-of-1.25.5/
Scores
CVSS v3
9.1
EPSS
0.0038
EPSS Percentile
30.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-294
Status
published
Products (1)
Gitea/Gitea Open Source Git Server
< 1.25.5
Published
Jul 03, 2026
Tracked Since
Jul 04, 2026