Gitea OAuth2 PKCE S256 verifier bypass
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-26247US | — | — | ||
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://blog.gitea.com/release-of-1.25.5WEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5WEB
- https://github.com/go-gitea/gitea/commit/bf8d11bb212ba2a76596d8a90e74e7d664571324WEB
- https://github.com/go-gitea/gitea/pull/36462WEB
- https://github.com/go-gitea/gitea/pull/36477WEB
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-26247ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan