CVE-2026-26247 — Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
Published: 2026-07-03 · CVSS: 9.1 · CVSS 3.1
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7