CVE-2026-26247: Gitea OAuth2 Auth Bypass Vulnerability

CVE-2026-26247 Overview

CVE-2026-26247 is an access control vulnerability in Gitea versions before 1.25.5. The flaw stems from the OAuth2 authorization server failing to persist the Proof Key for Code Exchange (PKCE) S256 challenge method during authorization requests. When the challenge method is not stored, Gitea does not enforce the expected verifier check during token exchange. Attackers who intercept an authorization code can redeem it for tokens without possessing the original PKCE verifier. The weakness is categorized under [CWE-284: Improper Access Control].

Critical Impact
Attackers can bypass PKCE verifier validation to exchange stolen authorization codes for OAuth2 access tokens, compromising the confidentiality and integrity of user accounts and repositories.

Affected Products

Gitea versions prior to 1.25.5
Self-hosted Gitea OAuth2 authorization server deployments
OAuth2 client applications relying on PKCE S256 protection when integrating with Gitea

Discovery Timeline

2026-07-03 - CVE-2026-26247 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-26247

Vulnerability Analysis

Gitea implements OAuth2 authorization with PKCE support to protect public clients against authorization code interception attacks. PKCE requires the client to send a code_challenge and code_challenge_method during the /authorize request, then submit the matching code_verifier during the /token exchange. The server must hash the verifier using the stored method and compare it to the original challenge.

In affected Gitea releases, the authorization server does not correctly persist the S256 challenge method alongside the issued authorization code. During token exchange, the missing method causes the verifier comparison logic to be skipped or evaluated incorrectly. As a result, the server accepts the authorization code without validating the code_verifier.

Root Cause

The root cause is improper state persistence in the OAuth2 authorization flow. The code_challenge_method value is not written to the authorization code record. When token exchange occurs, the server cannot determine which hashing algorithm to apply, and the verifier check does not enforce the binding established at authorization time. The upstream fix is tracked in Gitea Pull Request #36462 and Gitea Pull Request #36477.

Attack Vector

An attacker who obtains a victim's authorization code through log exposure, redirect URI manipulation, referer leakage, or a malicious client can present the code to the Gitea /login/oauth/access_token endpoint. Because the PKCE verifier check is not enforced, the attacker receives valid access and refresh tokens without knowing the original code_verifier. The attack requires no privileges and no user interaction beyond the initial authorization step.

The vulnerability is exploitable over the network against any Gitea instance below 1.25.5 that issues OAuth2 tokens to clients using PKCE. See the Gitea 1.25.5 Release Announcement for the vendor description.

Detection Methods for CVE-2026-26247

Indicators of Compromise

Successful OAuth2 token exchanges at /login/oauth/access_token from source IP addresses that differ from the IP address used during the corresponding /login/oauth/authorize request.
Token issuance events where the code_verifier parameter is absent or malformed but the response returns a valid access token.
Unexpected OAuth2 application authorizations appearing in user account settings.

Detection Strategies

Correlate authorization code issuance and redemption events by client ID and user, alerting on mismatches in user agent, IP, or timing.
Inspect Gitea access logs for /login/oauth/access_token POST requests followed by API calls to repositories or user endpoints from previously unseen tokens.
Review OAuth2 application audit trails for tokens issued to public clients that skip PKCE verification.

Monitoring Recommendations

Enable verbose OAuth2 logging in Gitea and forward logs to a centralized SIEM for retention and correlation.
Monitor for anomalous repository clone, push, or API activity performed by OAuth2 tokens shortly after issuance.
Track the running Gitea version across all instances and alert on any host reporting a version below 1.25.5.

How to Mitigate CVE-2026-26247

Immediate Actions Required

Upgrade all Gitea instances to version 1.25.5 or later using the release available at Gitea Release Tag v1.25.5.
Revoke existing OAuth2 access and refresh tokens after upgrading to invalidate any tokens that may have been issued through the flaw.
Rotate OAuth2 client secrets and audit registered OAuth2 applications for unauthorized entries.

Patch Information

Gitea addressed the flaw in version 1.25.5. The fix persists the PKCE code_challenge_method with the authorization code and enforces the verifier check during token exchange. Details are documented in Gitea Pull Request #36462 and Gitea Pull Request #36477.

Workarounds

Restrict access to the Gitea OAuth2 authorization endpoints to trusted networks until the upgrade is applied.
Disable OAuth2 application registration for untrusted users through Gitea administrative settings.
Require confidential OAuth2 clients with client secrets instead of public clients relying solely on PKCE where feasible.

bash

# Verify installed Gitea version and upgrade
gitea --version
# Expected output after patching: Gitea version 1.25.5 or later

# Revoke all OAuth2 tokens via the admin API after upgrade
curl -X DELETE \
  -H "Authorization: token $ADMIN_TOKEN" \
  https://gitea.example.com/api/v1/admin/users/{username}/oauth2/applications