CVE-2026-25779: Gitea Auth Bypass Vulnerability

CVE-2026-25779 Overview

CVE-2026-25779 is an open redirect vulnerability affecting Gitea versions up to and including 1.25.4. The flaw resides in the handling of the redirect_to parameter, where raw or percent-encoded backslash characters bypass the URL validation logic. Attackers can craft URLs that appear to point to a trusted Gitea instance but redirect victims to attacker-controlled destinations after authentication or link interaction. The issue is classified as CWE-601: URL Redirection to Untrusted Site. Gitea addressed the vulnerability in release 1.25.5.

Critical Impact
Attackers can weaponize trusted Gitea URLs to redirect authenticated users to phishing or credential-harvesting sites, enabling account takeover and supply chain compromise of source code repositories.

Affected Products

Gitea versions up to and including 1.25.4
Self-hosted Gitea instances exposing web authentication flows
Any Gitea deployment using the redirect_to query parameter for post-login navigation

Discovery Timeline

2026-07-03 - CVE-2026-25779 published to NVD
2026-07-07 - Last updated in NVD database
Release v1.25.5 - Gitea publishes fix via Pull Request #36660 and Pull Request #36716

Technical Details for CVE-2026-25779

Vulnerability Analysis

Gitea validates the redirect_to parameter to ensure users are only redirected to internal paths after authentication or specific actions. The validation logic checks for forward slash patterns and known external URL schemes but fails to normalize backslash characters. Attackers supply raw backslashes (\) or percent-encoded variants (%5C) inside the redirect_to value to construct URLs that bypass this validation.

Certain browsers and URL parsers treat backslashes as equivalent to forward slashes when resolving authority components. A crafted value such as \\attacker.example.com is interpreted by the browser as a protocol-relative reference to an external host, while Gitea's validator treats it as a relative path. The result is a redirect from the trusted Gitea origin to an attacker-controlled domain.

Root Cause

The root cause is incomplete input normalization in the redirect handler. The validator does not decode percent-encoded backslashes or convert backslashes to forward slashes before applying its allow-list logic. See the GitHub Security Advisory GHSA-j5r2-4c8j-xc3m for the maintainers' analysis.

Attack Vector

Exploitation requires user interaction. An attacker sends a victim a link to the legitimate Gitea instance containing a manipulated redirect_to value. After the victim authenticates or completes the triggering action, Gitea issues an HTTP redirect to the attacker-controlled host. The victim's browser follows the redirect from a trusted domain, which increases the likelihood of successful phishing. The vulnerability is exploitable over the network without prior privileges.

Refer to the Gitea 1.25.5 Release Announcement for maintainer commentary on the corrected redirect logic.

Detection Methods for CVE-2026-25779

Indicators of Compromise

HTTP request logs containing redirect_to parameters with raw backslash characters or the %5C percent-encoded sequence
Outbound HTTP 302 responses from Gitea pointing to hostnames outside the configured ROOT_URL
Referrer chains showing user sessions transitioning from the Gitea login flow to external domains

Detection Strategies

Parse Gitea access logs for query strings matching the regex redirect_to=[^&]*(\\|%5[Cc])
Correlate authentication events with subsequent redirect responses to identify off-domain navigation
Deploy web application firewall rules that reject redirect_to values containing backslashes prior to reaching Gitea

Monitoring Recommendations

Alert on Gitea versions at or below 1.25.4 discovered during asset inventory scans
Monitor phishing telemetry for lookalike domains targeting Gitea users and administrators
Track user-reported redirects that leave the expected Gitea hostname during login

How to Mitigate CVE-2026-25779

Immediate Actions Required

Upgrade Gitea to version 1.25.5 or later
Audit recent authentication logs for suspicious redirect_to parameter usage
Notify users of the phishing risk and remind them to verify destination URLs after login

Patch Information

Gitea released version 1.25.5 containing the fix. The corrective changes are delivered through Pull Request #36660 and Pull Request #36716, which normalize backslash characters before redirect target validation. Administrators should follow the standard upgrade procedure documented in the Gitea Release Announcement.

Workarounds

Place Gitea behind a reverse proxy that strips or rejects redirect_to values containing \ or %5C
Restrict outbound redirects at the proxy layer to the Gitea ROOT_URL domain only
Disable or shorten session lifetimes to limit the window of exposure until patching is complete

bash

# Example NGINX rule to block backslash payloads in redirect_to
if ($args ~* "redirect_to=[^&]*(\\|%5C)") {
    return 400;
}