CVE-2026-26232

CriticalCVSS 9.1

Published: 03/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

A vulnerability in Gitea versions before 1.25.5 allows reusing expired or single-use OAuth2 authorization codes during token exchange. Inconsistent enforcement of code expiry and single-use behavior may lead to unauthorized access.

Risk Assessment

The risk involves an attacker potentially intercepting and reusing authorization codes, leading to unauthorized access to user accounts and sensitive repository data.

Recommendation

Immediately upgrade Gitea to version 1.25.5 or later, which includes a fix enforcing proper OAuth2 code expiry and single-use behavior.

Original NVD description (English source)

Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.