{"id":"EUVD-2026-41628","enisaUuid":"35fdc458-e1c0-397d-89e5-fc936db21b01","description":"Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.","datePublished":"Jul 3, 2026, 8:19:34 PM","dateUpdated":"Jul 7, 2026, 4:59:23 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36797\nhttps://github.com/go-gitea/gitea/pull/36851\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-26232\nGHSA-5v69-g2m3-3hq3\n","assigner":"Gitea","epss":0.5,"enisaIdProduct":[{"id":"d48a6576-d4b9-3173-a93f-078d0891703a","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"5d3bb8aa-9ce1-34b4-bf55-412a80ed4ff2","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"140b1499-f045-3473-ae9c-fb662d02890a","vulnerability":{"id":"CVE-2026-26232","description":"Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.","datePublished":"Jul 3, 2026, 8:19:34 PM","dateUpdated":"Jul 7, 2026, 4:59:23 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36797\nhttps://github.com/go-gitea/gitea/pull/36851\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41628\n","assigner":"Gitea","epss":0.5,"dataProcessed":"Nov 7, 2026, 7:23:43 AM","vulnerabilityProduct":[{"id":"b361c497-6a7f-3dfc-b69a-b16014075ffb","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"f5523e94-12af-312c-b5ed-188a1032de2e","vendor":{"name":"Gitea"}}]}},{"id":"cf4e1f6b-b2f8-3ab5-b6e3-19d507422e16","vulnerability":{"id":"GHSA-5v69-g2m3-3hq3","description":"Gitea OAuth2 authorization codes can be reused after expiry","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:23:13 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-26232\nhttps://github.com/go-gitea/gitea/pull/36797\nhttps://github.com/go-gitea/gitea/pull/36851\nhttps://github.com/go-gitea/gitea/commit/413074b1e1dc5718b4865b9493d8cc97e1e128de\nhttps://github.com/go-gitea/gitea/commit/f3bdcc58aff60b66eba7bd5e9b23457441733dfe\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41628\n","aliases":"GHSA-5v69-g2m3-3hq3\nCVE-2026-26232\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}