CVE-2026-101023

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101023

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Gitea's OAuth2 token endpoint had a flaw where it did not properly verify that a token submitted with the refresh_token grant type was actually a refresh token. This allowed an attacker with an unexpired access token for the same OAuth2 application to exchange it for a new access token and refresh token, potentially gaining prolonged access beyond the original token's lifetime.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version 28.0.0 or earlier. Verify the OAuth refresh-token endpoint behavior by inspecting token exchange requests. Look for access tokens being used to obtain new refresh tokens without proper validation.

Impact Analysis

If you use Gitea's OAuth2 functionality, an attacker could exploit this to maintain unauthorized access to your account or resources even after the original access token expires. This could lead to data breaches, unauthorized actions, or persistent control over your OAuth2-enabled services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating principles of data protection and access control required by GDPR and HIPAA. It may result in non-compliance with data retention and access control policies, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Update Gitea to the latest version that patches this OAuth2 token endpoint vulnerability. Review and revoke any potentially compromised OAuth2 tokens and refresh tokens for applications using Gitea. Monitor for unusual token usage or unauthorized access.

Hi! I’m here to help you understand CVE-2026-101023. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70