Gitea OAuth2 Authorization Code Reuse Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- gitea (go)
- Affected versions
- < 1.25.5
- Patched version
- 1.25.5
An early warning has been issued for a high-severity vulnerability in Gitea versions before 1.25.5 that may allow OAuth2 authorization code reuse after expiry. Users of affected versions are advised to assess their exposure and take appropriate action.
What happened
Gitea versions before 1.25.5 reportedly do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange. This vulnerability, tracked as GHSA-5V69-G2M3-3HQ3, was first flagged on July 3, 2026. The issue is under investigation and has not been exploited in the wild as of the latest reports.
The vulnerability allows OAuth2 authorization codes to be reused after their expiry, which could potentially lead to unauthorized access if an attacker obtains a valid code. The affected component is the 'gitea' package in Go, with versions less than 1.25.5 being vulnerable.
What to do about it
- Upgrade to Gitea version 1.25.5 or later to mitigate the vulnerability.
- Review your OAuth2 authorization code management practices to ensure codes are properly invalidated after use or expiry.
- Monitor the primary sources for updates on the vulnerability and any additional mitigations that may be recommended.
How 0Day would have caught this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Gitea versions before 1.25.5, you are potentially affected by this vulnerability.
What should I do right now?
Upgrade to Gitea version 1.25.5 or later as soon as possible.
Has this vulnerability been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.