{"id":"EUVD-2026-41629","enisaUuid":"2b087490-3c5a-3136-a901-de7897513cba","description":"Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.","datePublished":"Jul 3, 2026, 8:19:34 PM","dateUpdated":"Jul 7, 2026, 4:59:17 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36462\nhttps://github.com/go-gitea/gitea/pull/36477\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-26247\nGHSA-m5ch-ppfx-xv3v\n","assigner":"Gitea","epss":0.5,"enisaIdProduct":[{"id":"650aeefe-9bd1-3c40-a191-e66d708a8d95","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"44d1f826-d767-3bb5-8023-5f855950cb86","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"816611ac-2af2-385f-ac32-f83e9aeb6635","vulnerability":{"id":"CVE-2026-26247","description":"Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.","datePublished":"Jul 3, 2026, 8:19:34 PM","dateUpdated":"Jul 7, 2026, 4:59:17 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36462\nhttps://github.com/go-gitea/gitea/pull/36477\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41629\n","assigner":"Gitea","epss":0.5,"dataProcessed":"Nov 7, 2026, 7:23:43 AM","vulnerabilityProduct":[{"id":"321eab64-4527-37d5-b627-e39fbda4b7be","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"46949232-61e6-3d55-a6b8-cd8d55b6bc32","vendor":{"name":"Gitea"}}]}},{"id":"c87e1642-6528-3647-8679-401503e5de88","vulnerability":{"id":"GHSA-m5ch-ppfx-xv3v","description":"Gitea OAuth2 PKCE S256 verifier bypass","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:23:03 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-26247\nhttps://github.com/go-gitea/gitea/pull/36462\nhttps://github.com/go-gitea/gitea/pull/36477\nhttps://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5\nhttps://github.com/go-gitea/gitea/commit/bf8d11bb212ba2a76596d8a90e74e7d664571324\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41629\n","aliases":"CVE-2026-26247\nGHSA-m5ch-ppfx-xv3v\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}