Executive brief
Gitea is an open-source forge software package for hosting software development version control using Git. A security flaw in its OAuth implementation allows any registered OAuth application to view sensitive details about login tokens belonging to other applications. This could allow an attacker to verify if stolen credentials are still active or map out user activity across different services connected to the Gitea instance.
Technical details
The OAuth2 introspection endpoint (`/login/oauth/introspect`) in Gitea violates RFC 7662 by returning token metadata to any authenticated OAuth client, regardless of whether the token was issued to that client. The root cause is in `IntrospectOAuth` within `routers/web/auth/oauth2_provider.go`, where the code reassigns the application context to the token's issuer without verifying it matches the requester's ID. An attacker with valid OAuth client credentials can submit tokens belonging to other clients to learn the token's status (active/inactive), associated username, and scope. This vulnerability was addressed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-04-24: other: Vulnerability confirmed in v1.26.1
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-21: disclosed: Full advisory disclosure