by Kastro
Paper/Archive/CVE-2026-26247

CVE-2026-26247

Gitea Gitea Open Source Git Server — Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.5.425 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

Affected

ProductAffectedFixed inSource
Gitea Open Source Git Server< 1.25.51.25.5CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/go-gitea/gitea/pull/36462patchgithub.com/go-gitea/gitea/pull/36477refgithub.com/go-gitea/gitea/releases/tag/v1.25.5refblog.gitea.com/release-of-1.25.5