Gitea Session Token Theft via Remember-Me

Executive Summary

CVE-2026-56750 is a vulnerability in Gitea where an attacker can steal a user's Remember-Me token and use it to authenticate. Gitea rotates the token's hash but keeps the same ID. When the legitimate user tries to use their original token, Gitea detects a hash mismatch and returns an error. However, it fails to invalidate all active Remember-Me sessions, allowing the attacker's session to persist indefinitely.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea logs for multiple authentication attempts using the same Remember-Me token ID but with mismatched hashes. Look for users reporting token failures despite valid credentials. Verify if attacker sessions persist after legitimate users authenticate.

Useful 0 Not Useful 0

Impact Analysis

If you use Gitea versions up to 1.26.4, an attacker who steals your Remember-Me token could gain unauthorized access to your account. Even after you attempt to log in again, the attacker's session remains active, potentially leading to prolonged unauthorized access to your data and projects.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Failure to invalidate compromised sessions may result in non-compliance with data protection principles, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later immediately. Review and manually invalidate all active Remember-Me tokens in the database for affected users. Monitor for unauthorized access attempts post-upgrade.

Useful 0 Not Useful 0