CVE-2026-26247

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N                                    

Vulnerability Description

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

Vulnerability Details

Published Date

July 03, 2026

Last Modified

July 07, 2026

CWE ID

CWE-284

Source

NVD

Vendor

Gitea

Product

Gitea Open Source Git Server

External References

https://blog.gitea.com/release-of-1.25.5/
https://github.com/go-gitea/gitea/pull/36462
https://github.com/go-gitea/gitea/pull/36477
https://github.com/go-gitea/gitea/releases/tag/v1.25.5

CVE-2026-26247

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment