[CVE-2026-26247] Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during a…

Descripción técnica

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

Puntuación CVSS

Score: 9.1/10 — Severidad: CRITICAL — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Debilidades (CWE)

CWE-284

Fuente oficial

Publicado en NIST NVD.