Executive brief
Gitea is a self-hosted Git service that supports OAuth2 authentication for third-party application integration. A flaw in versions before 1.25.5 fails to enforce the expiration and single-use requirements of OAuth2 authorization codes, allowing attackers who intercept these codes to reuse them indefinitely. This can result in unauthorized access to user accounts and any data or resources accessible through integrated applications.
Technical details
The vulnerability is an authentication bypass via capture-replay (CWE-294) in Gitea's OAuth2 token exchange mechanism. Prior to version 1.25.5, the system did not properly validate the expiration timestamp (ValidUntil) of authorization codes or enforce single-use semantics during the token exchange process. An attacker who captures an OAuth2 authorization code can replay it multiple times to obtain valid access tokens, even if the code has expired. The fix sets the ValidUntil timestamp on code creation, adds expiry checks during token exchange, and returns a specific error when codes are invalidated multiple times to prevent concurrent reuse. The attack requires network access to the OAuth2 endpoint but no prior authentication or user interaction.
Affected products
- Gitea Gitea < 1.25.5
Timeline
- 2026-07-03: disclosed: Published in GitHub Advisory Database
- 2026-03-16: patched: Patched in version 1.25.5 released March 16, 2026