CRITICAL9.1

GHSA-m5ch-ppfx-xv3v

Gitea OAuth2 PKCE S256 verifier bypass

Quick fix

GHSA-m5ch-ppfx-xv3v — code.gitea.io/gitea: upgrade to the fixed version with the command below.

go get code.gitea.io/gitea@v1.25.5

Details

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/code.gitea.io/gitea

Introduced in: 0Fixed in: 1.25.5

Fixgo get code.gitea.io/gitea@v1.25.5

References

https://nvd.nist.gov/vuln/detail/CVE-2026-26247[ADVISORY]
https://github.com/go-gitea/gitea/pull/36462[WEB]
https://github.com/go-gitea/gitea/pull/36477[WEB]
https://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5[WEB]
https://github.com/go-gitea/gitea/commit/bf8d11bb212ba2a76596d8a90e74e7d664571324[WEB]
https://blog.gitea.com/release-of-1.25.5[WEB]
https://github.com/go-gitea/gitea[PACKAGE]
https://github.com/go-gitea/gitea/releases/tag/v1.25.5[WEB]