CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session
The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).
The vulnerable function is this one:
References
- github.com/advisories/GHSA-rgv6-xp99-6mgj
- github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31
- github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf
- github.com/go-gitea/gitea/pull/38406
- github.com/go-gitea/gitea/pull/38426
- github.com/go-gitea/gitea/releases/tag/v1.27.0
- github.com/go-gitea/gitea/security/advisories/GHSA-rgv6-xp99-6mgj
- nvd.nist.gov/vuln/detail/CVE-2026-56750
Code Behaviors & Features
Detect and mitigate CVE-2026-56750 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →