judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass

PoC

An explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.

view exploit source poc_in_githubauthor judgedbykirapublished 2026-08-15catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-20896US	—	2.76% (86th)	Exploit	2026-07-03
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authenticatio…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan