CVE-2026-26247: Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Published Jul 3, 2026
·Updated
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
Affected Software
1 affected component
Gitea Gitea<1.25.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Giteato a version that resolves this vulnerability.Fixed in 1.25.5
Event History
Jul 3, 2026
CVE Published
via MITRE·08:19 PM
Data Sourced
via MITRE·08:19 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-26247?
CVE-2026-26247 has a risk score of 45, indicating a moderate level of severity.
2
How do I fix CVE-2026-26247?
To fix CVE-2026-26247, upgrade to Gitea version 1.25.5 or later.
3
What does CVE-2026-26247 affect?
CVE-2026-26247 affects Gitea versions prior to 1.25.5, specifically concerning OAuth2 PKCE S256 challenge handling.
4
What is the vulnerability in CVE-2026-26247?
CVE-2026-26247 allows token exchange without the required verifier check due to improper enforcement of the OAuth2 PKCE S256 challenge.
5
When was CVE-2026-26247 published?
CVE-2026-26247 was published on July 3, 2026.