CVE-2026-26247

EUVD-2026-41629
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://blog.gitea.com/release-of-1.25.5/
https://github.com/go-gitea/gitea/pull/36462
https://github.com/go-gitea/gitea/pull/36477
https://github.com/go-gitea/gitea/releases/tag/v1.25.5