CVE-2026-20779 Overview
CVE-2026-20779 is a two-factor authentication flaw in Gitea, an open source self-hosted Git service. Gitea versions from 1.5.0 before 1.26.3 fail to enforce single-use semantics on Time-based One-Time Password (TOTP) codes. A valid TOTP value can be accepted more than once across the web two-factor authentication flow and the Basic Auth X-Gitea-OTP header path. This weakness maps to CWE-294: Authentication Bypass by Capture-replay and undermines the replay resistance that TOTP is designed to provide.
Critical Impact
An attacker who captures a valid TOTP value from a legitimate user can replay it during its short validity window to authenticate against Gitea web sessions or Basic Auth API endpoints.
Affected Products
- Gitea versions 1.5.0 through 1.26.2
- Gitea web two-factor authentication flow
- Gitea Basic Auth X-Gitea-OTP header authentication path
Discovery Timeline
- 2026-07-03 - CVE-2026-20779 published to NVD
- 2026-07-07 - Last updated in NVD database
- Fix released in Gitea 1.26.3 and documented in GHSA-gx3v-q759-g323
Technical Details for CVE-2026-20779
Vulnerability Analysis
TOTP codes are designed to be valid for a single authentication event within their time step, typically 30 seconds. Gitea generated and verified TOTP values correctly, but did not record and reject values that had already been consumed. The server accepted the same six-digit code repeatedly as long as it remained within the current time window. This behavior converts TOTP from a one-time credential into a short-lived shared secret. The defect affected both the interactive web login two-factor step and the programmatic Basic Auth path that reads the X-Gitea-OTP request header. The fix landed in pull request #38151, which introduces used-code tracking so that a given TOTP value cannot be replayed for the same account.
Root Cause
The root cause is missing state tracking of consumed TOTP values. Gitea validated each submitted code against the current time step but did not persist previously accepted codes for the account. Without a used-code cache tied to the user and the time window, the second-factor check reduced to "is the code currently valid," which is insufficient replay protection under [CWE-294].
Attack Vector
An attacker must obtain a valid TOTP value produced by a legitimate user. Capture paths include shoulder surfing, phishing pages that proxy authentication, malware on the user endpoint, or interception of a Basic Auth request that includes the X-Gitea-OTP header. Once captured, the attacker replays the code against the Gitea web login or an API endpoint using Basic Auth before the time window expires. User interaction is required to originate the code, which is reflected in the CVSS vector, but no privileges are required on the server side.
No public proof-of-concept exploit code is listed in the advisory. See the Gitea security advisory GHSA-gx3v-q759-g323 for authoritative technical detail.
Detection Methods for CVE-2026-20779
Indicators of Compromise
- Successful authentications for the same account from two different source IP addresses within a single 30-second TOTP window.
- Multiple accepted logins that log the same TOTP code value or that occur suspiciously close together for one user.
- Basic Auth requests carrying the X-Gitea-OTP header from unexpected client IPs, user agents, or geolocations.
- Session creation events on Gitea shortly after a phishing or proxy-in-the-middle event targeting a user.
Detection Strategies
- Correlate Gitea authentication logs with source IP, user agent, and timestamp to identify parallel logins for the same user inside a short window.
- Alert on any repeated use of an identical TOTP value in application logs where the value is recorded.
- Baseline API clients that submit the X-Gitea-OTP header and flag deviations in source or frequency.
Monitoring Recommendations
- Ship Gitea access and authentication logs to a central analytics platform for cross-session correlation.
- Monitor Git operations that follow a two-factor login for anomalous repository cloning, token creation, or SSH key additions.
- Track creation of new personal access tokens and OAuth applications immediately after 2FA login events.
How to Mitigate CVE-2026-20779
Immediate Actions Required
- Upgrade Gitea to version 1.26.3 or later, as announced in the Gitea 1.26.3 and 1.26.4 release blog.
- Audit recent two-factor authentications and Basic Auth API activity for signs of replay across accounts with 2FA enabled.
- Rotate personal access tokens, OAuth client secrets, and SSH keys for any account showing suspicious concurrent logins.
- Force session invalidation for all users after upgrading to eliminate any sessions established through replay.
Patch Information
The fix is included in Gitea 1.26.3. See the release notes and the merged pull request #38151 for the code change that introduces single-use enforcement for TOTP values.
Workarounds
- Prefer WebAuthn or hardware security keys over TOTP for privileged accounts until the upgrade is complete.
- Restrict Basic Auth API access to trusted networks using a reverse proxy or firewall to limit exposure of the X-Gitea-OTP path.
- Shorten session lifetimes and require re-authentication for sensitive administrative actions.
- Enforce IP allowlisting for administrator and service accounts where feasible.
# Verify Gitea version after upgrade
gitea --version
# Example: pull the fixed container image
docker pull gitea/gitea:1.26.3
# Restart the service after upgrade
systemctl restart gitea
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
