CVE-2026-56750

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An issue exists in the Remember-Me token validation logic where the system fails to invalidate all active sessions when a compromised token is detected. Gitea uses a split token design consisting of an ID and a Hash. When a token is used, the Hash is rotated while the ID remains constant. If an attacker steals a token and authenticates, they receive a new rotated token. When the legitimate user subsequently attempts to use their original token, the system detects a hash mismatch. While the CheckAuthToken() function identifies this mismatch, the autoSignIn process only deletes the local cookie of the victim and does not remove the compromised token from the database. This allows an attacker to maintain persistent access to the account. The affected endpoint is POST /user/login and any other endpoint that triggers autoSignIn via the Remember-Me cookie.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.