CVE-2026-20779: TOTP Single-Use Enforcement Defect in Gitea
Vulnerability ID: CVE-2026-20779
CVSS Score: 7.1
Published: 2026-07-21
Gitea versions from 1.5.0 before 1.26.3 contain a security vulnerability in their multi-factor authentication (MFA) logic. This vulnerability allows valid TOTP codes to be accepted multiple times across web authentication flows and the Basic Auth X-Gitea-OTP header path. Due to a TOCTOU race condition and a lack of state tracking in programmatic auth pathways, attackers with valid credentials can replay single-use OTP codes.
TL;DR
A high-severity authentication bypass in Gitea allows attackers to replay TOTP codes across web and API paths due to database race conditions and missing state tracking.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-294 (Bypass of Authentication Mechanism Using Replay)
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.1 (High)
- EPSS Score: 0.00481 (Percentile: 38.44%)
- Exploit Status: Proof of Concept (PoC) available
- CISA KEV Status: Not Listed
- Affected Versions: v1.5.0 to < v1.26.3
Affected Systems
- Gitea Open Source Git Server
Mitigation Strategies
- Upgrade Gitea to version 1.26.3 or higher immediately.
- Restrict or disable password-based basic authentication over HTTP/HTTPS in favor of SSH keys.
- Implement rate-limiting on authentication endpoints (/user/two_factor and API endpoints) at the reverse proxy layer.
Remediation Steps:
- Step 1: Identify all running Gitea instances and verify their versions.
- Step 2: Back up the Gitea database and configuration files (app.ini).
- Step 3: Deploy the updated Gitea binary or container image (v1.26.3 or later).
- Step 4: Verify the TOTP single-use policy by attempting a replay of a used OTP on the user/two_factor interface.
References
Read the full report for CVE-2026-20779 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)