CVE-2026-26232: Gitea OAuth2 authorization codes can be reused after expiry
(updated )
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
References
- blog.gitea.com/release-of-1.25.5
- github.com/advisories/GHSA-5v69-g2m3-3hq3
- github.com/go-gitea/gitea/commit/413074b1e1dc5718b4865b9493d8cc97e1e128de
- github.com/go-gitea/gitea/commit/f3bdcc58aff60b66eba7bd5e9b23457441733dfe
- github.com/go-gitea/gitea/pull/36797
- github.com/go-gitea/gitea/pull/36851
- github.com/go-gitea/gitea/releases/tag/v1.25.5
- nvd.nist.gov/vuln/detail/CVE-2026-26232
Code Behaviors & Features
Detect and mitigate CVE-2026-26232 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →