Описание
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
Ссылки
EPSS
Процентиль: 42%
0.00492
Низкий
7.1 High
CVSS3
Дефекты
CWE-294
Связанные уязвимости
CVSS3: 7.1
debian
4 месяца назад
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforce ...
CVSS3: 7.1
github
4 месяца назад
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
CVSS3: 9.8
altlinux
2 месяца назад
ALT-PU-2026-14138: package `gitea` update to version 1.27.2-alt1
CVSS3: 9.8
altlinux
около 2 месяцев назад
ALT-PU-2026-16069: package `gitea` update to version 1.27.3-alt1
EPSS
Процентиль: 42%
0.00492
Низкий
7.1 High
CVSS3
Дефекты
CWE-294