Gitea OAuth2 PKCE S256 verifier bypass
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-26247US | — | — | ||
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check. | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-1.25.5WEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5WEB
- https://github.com/go-gitea/gitea/commit/bf8d11bb212ba2a76596d8a90e74e7d664571324WEB
- https://github.com/go-gitea/gitea/pull/36462WEB
- https://github.com/go-gitea/gitea/pull/36477WEB
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-26247ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan