Skip to content
Heist/ feed
Back to feed
Critical

Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange

Type: advisorySources: OSV

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-26247
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 19:31 UTC · Revision 1

Source evidence

Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange

core-osv · Original source

Published 3 Jul 2026, 20:19 UTC

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

osv:CVE-2026-26247
Complete source record
{
  "id": "5001d6d6ac2f67b5750771664053a7081ce849d5563c8773ae12b3e6c3bc4329",
  "url": "https://osv.dev/vulnerability/CVE-2026-26247",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange",
    "summary": "Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.",
    "evidence": "osv:CVE-2026-26247",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-26247",
      "aliases": [
        "CVE-2026-26247",
        "GHSA-m5ch-ppfx-xv3v",
        "GO-2026-6342"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "f913d90ab664c1deccdfbe8c563abb13e897d62b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.25.5"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "f913d90ab664c1deccdfbe8c563abb13e897d62b"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.25.5"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.25.5"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.25.4",
            "v1.25.3",
            "v1.25.2",
            "v1.25.1",
            "v1.25.0",
            "v1.25.0-rc0",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26247.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:22.620829976Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-1.25.5/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26247.json",
        "https://github.com/go-gitea/gitea/releases/tag/v1.25.5",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-26247",
        "https://github.com/go-gitea/gitea/pull/36462",
        "https://github.com/go-gitea/gitea/pull/36477"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-284"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26247.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-26247",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 489200,
  "published_at": "2026-07-03T20:19:34.82+00:00"
}