OAuth2 Token Exchange Flaw in Gitea

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-26232

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 1.25.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This vulnerability affects Gitea versions before 1.25.5. It involves the OAuth2 authorization code process, where the system does not consistently enforce the expiration and single-use rules for authorization codes during the token exchange phase.

Impact Analysis

Because the OAuth2 authorization codes may not expire or be limited to a single use, an attacker could potentially reuse an authorization code to obtain access tokens multiple times. This could lead to unauthorized access to user accounts or resources.

Hi! I’m here to help you understand CVE-2026-26232. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70