CVE-2026-26247CWE-284

Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange

Critical · published July 3, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
    cvelistv5