# CVE-2026-26247: Gitea OAuth2 PKCE S256 verifier bypass

Source: https://junglewise.ai/threats/cve-2026-26247-gitea-oauth2-pkce-s256-verifier-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26247 · Severity: critical · CVSS 9.1 · Published 2026-07-03

Gitea is a self-hosted Git repository management platform that uses OAuth2 to delegate user authentication and authorization. This vulnerability allows attackers to bypass the PKCE (Proof Key for Code Exchange) S256 security mechanism, which is designed to prevent token interception attacks. An attacker could exploit this to obtain valid access tokens without proper verification, potentially gaining unauthorized access to user accounts and repository data.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea), [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-26247 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26247 being exploited in the wild.

**How severe is CVE-2026-26247?** Critical severity, with a CVSS score of 9.1, published 3 July 2026.

**Which products and versions are affected?** Gitea before 1.25.5; code.gitea.io/gitea (Go) < 1.25.5, SEMVER:introduced=0,fixed=1.25.5.

**Is there a fix for CVE-2026-26247?** Yes. code.gitea.io/gitea (Go): upgrade to 1.25.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26247 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-26247?** Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.25.5 or later

  ```sh
  go get code.gitea.io/gitea@v1.25.5
  ```


## Technical details

The vulnerability exists in Gitea's OAuth2 provider implementation where the PKCE S256 (SHA-256) challenge method is not properly persisted during the authorization code flow. PKCE is a security extension to OAuth2 that requires clients to prove knowledge of a secret verifier during token exchange, protecting against authorization code interception attacks. Attackers without network access privileges can initiate OAuth2 flows and exchange authorization codes for tokens without providing the correct PKCE verifier, due to the missing or incorrect validation. This requires no user interaction and affects confidentiality and integrity of authenticated sessions. The vulnerability affects Gitea versions before 1.25.5; patches are available in version 1.25.5 and later.

## Affected products

- Gitea Gitea before 1.25.5

## Identifiers

- CVE-2026-26247
- GHSA-m5ch-ppfx-xv3v
- GO-2026-6342

## Timeline

- 2026-07-03: disclosed: Published to GitHub Advisory Database
- 2026-03-13: patched: Gitea 1.25.5 released with fix
- 2026-01-27: other: Fix merged in pull request #36462

## References

- [https://github.com/go-gitea/gitea/pull/36462](https://github.com/go-gitea/gitea/pull/36462)
- [https://github.com/go-gitea/gitea/pull/36477](https://github.com/go-gitea/gitea/pull/36477)
- [https://blog.gitea.com/release-of-1.25.5](https://blog.gitea.com/release-of-1.25.5)
- [https://github.com/go-gitea/gitea/releases/tag/v1.25.5](https://github.com/go-gitea/gitea/releases/tag/v1.25.5)
- [https://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5](https://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)