Is CVE-2026-26247 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26247 being exploited in the wild.

How severe is CVE-2026-26247?

Critical severity, with a CVSS score of 9.1, published 3 July 2026.

Which products and versions are affected?

Gitea before 1.25.5; code.gitea.io/gitea (Go) < 1.25.5, SEMVER:introduced=0,fixed=1.25.5.

Is there a fix for CVE-2026-26247?

Yes. code.gitea.io/gitea (Go): upgrade to 1.25.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26247 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-26247?

Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26247: Gitea OAuth2 PKCE S256 verifier bypass

Q: Is there a fix for CVE-2026-26247?

Yes. code.gitea.io/gitea (Go): upgrade to 1.25.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-26247 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-26247?

Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26247 · Severity: critical · CVSS 9.1 · Published 2026-07-03

Gitea is a self-hosted Git repository management platform that uses OAuth2 to delegate user authentication and authorization. This vulnerability allows attackers to bypass the PKCE (Proof Key for Code Exchange) S256 security mechanism, which is designed to prevent token interception attacks. An attacker could exploit this to obtain valid access tokens without proper verification, potentially gaining unauthorized access to user accounts and repository data.

Technologies: Gitea, code.gitea.io/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-26247 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26247 being exploited in the wild.
How severe is CVE-2026-26247?: Critical severity, with a CVSS score of 9.1, published 3 July 2026.
Which products and versions are affected?: Gitea before 1.25.5; code.gitea.io/gitea (Go) < 1.25.5, SEMVER:introduced=0,fixed=1.25.5.
Is there a fix for CVE-2026-26247?: Yes. code.gitea.io/gitea (Go): upgrade to 1.25.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26247 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-26247?: Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.25.5 or later
```
go get code.gitea.io/gitea@v1.25.5
```

Technical details

The vulnerability exists in Gitea's OAuth2 provider implementation where the PKCE S256 (SHA-256) challenge method is not properly persisted during the authorization code flow. PKCE is a security extension to OAuth2 that requires clients to prove knowledge of a secret verifier during token exchange, protecting against authorization code interception attacks. Attackers without network access privileges can initiate OAuth2 flows and exchange authorization codes for tokens without providing the correct PKCE verifier, due to the missing or incorrect validation. This requires no user interaction and affects confidentiality and integrity of authenticated sessions. The vulnerability affects Gitea versions before 1.25.5; patches are available in version 1.25.5 and later.

Affected products

Gitea Gitea before 1.25.5

Identifiers

CVE-2026-26247
GHSA-m5ch-ppfx-xv3v
GO-2026-6342

Timeline

2026-07-03: disclosed: Published to GitHub Advisory Database
2026-03-13: patched: Gitea 1.25.5 released with fix
2026-01-27: other: Fix merged in pull request #36462

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.