CVE-2026-26232: Gitea OAuth2 Auth Bypass Vulnerability

CVE-2026-26232 Overview

CVE-2026-26232 affects Gitea versions before 1.25.5. The vulnerability stems from inconsistent enforcement of OAuth2 authorization code expiry and single-use behavior during the token exchange process. This weakness falls under [CWE-294] (Authentication Bypass by Capture-replay).

Attackers with network access can potentially replay authorization codes to obtain OAuth2 tokens outside the intended validity window or reuse codes that should have been invalidated. The vulnerability requires no authentication and no user interaction to exploit.

Critical Impact
Attackers can replay or reuse OAuth2 authorization codes to obtain unauthorized access tokens, compromising the confidentiality and integrity of Gitea user accounts and repositories.

Affected Products

Gitea versions prior to 1.25.5
Self-hosted Gitea instances using OAuth2 provider functionality
Third-party applications relying on Gitea as an OAuth2 identity provider

Discovery Timeline

2026-07-03 - CVE-2026-26232 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-26232

Vulnerability Analysis

OAuth2 authorization codes must be short-lived and single-use to prevent replay attacks. The OAuth2 specification (RFC 6749) requires that authorization servers invalidate codes immediately after a successful token exchange and reject codes that have exceeded their expiry window.

Gitea versions before 1.25.5 failed to consistently enforce these two invariants. The token exchange endpoint accepted authorization codes under conditions where they should have been rejected. This allowed an attacker who intercepts or otherwise obtains an authorization code to exchange it for access tokens outside the boundaries defined by the OAuth2 protocol.

Root Cause

The root cause is inconsistent state management in Gitea's OAuth2 token exchange logic. Expiry checks and single-use enforcement were not uniformly applied across all code paths handling the authorization_code grant type. This is a classic [CWE-294] authentication bypass by capture-replay condition.

The fix was delivered through Gitea Pull Request #36797 and follow-up Pull Request #36851, which harden the token exchange path to reliably invalidate consumed codes and reject expired ones.

Attack Vector

Exploitation requires an attacker to obtain a valid OAuth2 authorization code. This can occur through referrer leakage, logs, redirect URI manipulation, browser history exposure, or interception on insufficiently protected transport channels. Once obtained, the attacker submits the code to the Gitea /login/oauth/access_token endpoint. Because Gitea does not consistently enforce single-use and expiry, the endpoint may issue access tokens for a code that should have been rejected.

The resulting access token grants the attacker the OAuth2 scopes originally requested by the legitimate client, potentially exposing repositories, user profile data, and write access to Gitea resources.

Detection Methods for CVE-2026-26232

Indicators of Compromise

Multiple successful token exchanges using the same code parameter in Gitea access logs
Token exchange requests occurring long after the associated authorization request timestamp
Access tokens issued to OAuth2 clients from unexpected IP addresses or user agents
Anomalous spikes in /login/oauth/access_token requests from a single client identifier

Detection Strategies

Parse Gitea application logs to identify duplicate use of the same authorization code across token exchange requests
Correlate authorization code issuance timestamps against token exchange timestamps to detect expiry violations
Alert on OAuth2 access tokens issued to sessions that geographically or behaviorally diverge from the original authorizing user

Monitoring Recommendations

Enable verbose OAuth2 logging in Gitea and forward logs to a centralized SIEM for correlation
Monitor authentication and token issuance events for OAuth2 client applications integrated with Gitea
Review third-party OAuth2 client audit logs for unexpected token grants or session creations following the disclosure window

How to Mitigate CVE-2026-26232

Immediate Actions Required

Upgrade all Gitea instances to version 1.25.5 or later without delay
Rotate OAuth2 client secrets for applications integrated with the affected Gitea instance
Invalidate active OAuth2 sessions and refresh tokens issued prior to patching
Audit OAuth2 application authorizations in Gitea and revoke any that appear unfamiliar or unused

Patch Information

Gitea has released version 1.25.5 containing the fix. Review the Gitea 1.25.5 Release Announcement and the Gitea v1.25.5 Release Notes. The corrective changes are implemented in Pull Request #36797 and Pull Request #36851.

Workarounds

Restrict network access to the Gitea OAuth2 endpoints to trusted client applications only, using a reverse proxy or network policy
Enforce strict HTTPS with HSTS across Gitea and all registered OAuth2 client redirect URIs to reduce the chance of authorization code interception
Shorten OAuth2 session lifetimes and require re-authentication for sensitive operations until the upgrade is complete

bash

# Upgrade Gitea to a patched version (binary install example)
systemctl stop gitea
wget https://dl.gitea.com/gitea/1.25.5/gitea-1.25.5-linux-amd64 -O /usr/local/bin/gitea
chmod +x /usr/local/bin/gitea
systemctl start gitea
gitea --version