CVE
CVE-2026-26247
Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
-
Related Resources
No items found.
References
https://blog.gitea.com/release-of-1.25.5/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26247.json, https://github.com/go-gitea/gitea/releases/tag/v1.25.5, https://nvd.nist.gov/vuln/detail/CVE-2026-26247, https://github.com/go-gitea/gitea/pull/36462, https://github.com/go-gitea/gitea/pull/36477