9.1
Critique
CVE-2026-26247 Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization,…
Description
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Gitea Open Source Git Server 1.25 | premières → < 1.25.5 | 1.25.5 |
Références
- GitHub Pull Request #36462 github.com
- GitHub Pull Request #36477 github.com
- Gitea v1.25.5 Release github.com
- Gitea v1.25.5 Release Blog Post blog.gitea.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Gitea Open Source Git Server
Les 97 CVE de Gitea Open Source Git Server →
CVE-2026-24791
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
8.1
Élevée
CVE-2026-24059
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents)…
6.5
Moyenne
CVE-2026-59765
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
7.5
Élevée
CVE-2026-58510
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on…
4.3
Moyenne