CVE-2026-58422: OAuth Authentication Bypass Vulnerability

CVE-2026-58422 Overview

CVE-2026-58422 is an improper authorization vulnerability in Gitea, an open-source self-hosted Git service. The flaw resides in the OAuth sign-in callback handler, which fails to verify the enabled status of a user account before completing authentication. As a result, an administrator-disabled account is silently re-enabled when the associated user completes an OAuth sign-in flow. The issue is classified under [CWE-284] Improper Access Control and affects Gitea releases prior to 1.26.4.

Critical Impact
Attackers retaining valid OAuth credentials for a disabled account can restore access without administrator involvement, defeating account suspension as a containment control.

Affected Products

Gitea versions prior to 1.26.3
Gitea versions prior to 1.26.4
Self-hosted Gitea instances configured with OAuth2 identity providers

Discovery Timeline

2026-07-03 - CVE-2026-58422 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-58422

Vulnerability Analysis

Gitea supports OAuth2 sign-in through external identity providers. When a user completes the OAuth flow, Gitea invokes a callback handler that maps the returned identity to a local Gitea account and issues a session. The vulnerable code path completes this session issuance without checking whether the mapped local account has been disabled by an administrator. Administrators disable accounts to revoke access during offboarding, incident response, or policy enforcement. Because the callback silently re-enables the account, the intended suspension has no durable effect against users who still control a linked OAuth identity.

The advisory GHSA-g9g6-qhrc-p3qc and the corresponding fix in pull request #38009 address the missing authorization check in the sign-in callback.

Root Cause

The root cause is a missing authorization state check in the OAuth callback handler. The code validated the OAuth assertion and located the local user record but did not evaluate the IsActive (disabled) flag before issuing a session. Additionally, the account status was mutated back to enabled during login rather than treated as an immutable administrative decision.

Attack Vector

Exploitation requires that an attacker or the original account holder retain valid credentials at a linked OAuth identity provider for a Gitea account that an administrator has disabled. The attacker initiates the standard OAuth sign-in flow against the Gitea instance. Upon successful assertion, Gitea re-enables the local account and issues an authenticated session, restoring repository, issue, and API access. No user interaction with the Gitea administrator is required, and the operation may not be surfaced in administrative audit views.

No verified proof-of-concept code has been published. Refer to the Gitea Release Announcement and Gitea Release Tag v1.26.4 for release-level details.

Detection Methods for CVE-2026-58422

Indicators of Compromise

Successful OAuth sign-in events for user accounts previously marked disabled in the Gitea admin console.
Unexpected transitions of the is_active column from false to true in the Gitea user table without an administrator action in the audit log.
Git operations, API tokens, or SSH key usage tied to accounts that were expected to be suspended.

Detection Strategies

Query the Gitea database periodically for accounts whose is_active flag changed outside of administrator-initiated workflows.
Correlate identity provider sign-in logs with Gitea authentication logs to identify OAuth callbacks that resulted in account state changes.
Alert on repository access or push events by user IDs that appear on an internal suspension list maintained outside Gitea.

Monitoring Recommendations

Forward Gitea application logs and identity provider logs to a centralized analytics platform for correlation and long-term retention.
Baseline OAuth callback volume per user and flag accounts that authenticate after a disable event.
Monitor administrative endpoints for state changes and require ticket references or change management approvals for reactivations.

How to Mitigate CVE-2026-58422

Immediate Actions Required

Upgrade all Gitea instances to version 1.26.4 or later, as documented in the Gitea Release Announcement.
Audit the user table for accounts that were disabled and later re-enabled without a corresponding administrator action, and re-disable as required.
Revoke active sessions, personal access tokens, and OAuth application grants held by any account that was previously disabled.

Patch Information

The fix ships in Gitea 1.26.4 via pull request #38009. The patched callback checks the account's disabled state before completing authentication and no longer mutates the enabled flag as a side effect of OAuth sign-in. Deployment details are published in the Gitea Release Tag v1.26.4 notes.

Workarounds

Disable OAuth2 authentication sources in the Gitea admin panel until the upgrade to 1.26.4 is completed.
Remove the linked external identity from disabled accounts so no valid OAuth assertion can be produced for them.
Rotate or revoke OAuth client credentials at the identity provider for high-risk disabled accounts to break the callback chain.

bash

# Configuration example
# Disable OAuth2 auth sources via the Gitea CLI until patched
gitea admin auth list
gitea admin auth update-oauth --id <AUTH_SOURCE_ID> --not-active