CVE-2026-20779 — Gitea TOTP single-use enforcement defect allows OTP replay
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authenticatio…
Published: 2026-07-03 · CVSS: 7.1 · CVSS 3.1
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7