Unrated severityNVD Advisory· Published Jul 3, 2026· Updated Jul 7, 2026
Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
CVE-2026-26247
Description
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/go-gitea/gitea/pull/36462mitrepatch
- github.com/go-gitea/gitea/pull/36477mitrepatch
- blog.gitea.com/release-of-1.25.5/mitrerelease-notes
- github.com/go-gitea/gitea/releases/tag/v1.25.5mitrerelease-notes
News mentions
0No linked articles in our index yet.