CVE-2026-26232

Aliases:GHSA-5v69-g2m3-3hq3GO-2026-6336
Advisory lineage Upstream: 0 Downstream: 1
Deferred
Published: 03 Jul 2026, 20:19
Last modified:07 Jul 2026, 16:59

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (cve.org)
EPSS Score
0.5% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

03 Jul 2026, 20:19
Published
Vulnerability first disclosed
07 Jul 2026, 16:59
Last Modified
Vulnerability information updated

Description

Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.50%• Percentile: 42%

Techniques & Countermeasures

  • CWE-294•Authentication Bypass by Capture-replay

    A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Affected Systems

  • gitea•gitea open source git server

    < 1.25.5

  • code.gitea.io•gitea

    < 1.25.5

References (10)