CVE-2026-20779: TOTP Single-Use Enforcement Defect in Gitea

Vulnerability ID: CVE-2026-20779
CVSS Score: 7.1
Published: 2026-07-21

Gitea versions from 1.5.0 before 1.26.3 contain a security vulnerability in their multi-factor authentication (MFA) logic. This vulnerability allows valid TOTP codes to be accepted multiple times across web authentication flows and the Basic Auth X-Gitea-OTP header path. Due to a TOCTOU race condition and a lack of state tracking in programmatic auth pathways, attackers with valid credentials can replay single-use OTP codes.

TL;DR

A high-severity authentication bypass in Gitea allows attackers to replay TOTP codes across web and API paths due to database race conditions and missing state tracking.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-294 (Bypass of Authentication Mechanism Using Replay)
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 7.1 (High)
• EPSS Score: 0.00481 (Percentile: 38.44%)
• Exploit Status: Proof of Concept (PoC) available
• CISA KEV Status: Not Listed
• Affected Versions: v1.5.0 to < v1.26.3

Affected Systems

• Gitea Open Source Git Server

Mitigation Strategies

• Upgrade Gitea to version 1.26.3 or higher immediately.
• Restrict or disable password-based basic authentication over HTTP/HTTPS in favor of SSH keys.
• Implement rate-limiting on authentication endpoints (/user/two_factor and API endpoints) at the reverse proxy layer.

Remediation Steps:

1. Step 1: Identify all running Gitea instances and verify their versions.
2. Step 2: Back up the Gitea database and configuration files (app.ini).
3. Step 3: Deploy the updated Gitea binary or container image (v1.26.3 or later).
4. Step 4: Verify the TOTP single-use policy by attempting a replay of a used OTP on the user/two_factor interface.

References

• Gitea v1.26.3 Release Tag
• Gitea v1.26.3 and v1.26.4 Security Release Blog

Read the full report for CVE-2026-20779 on our website for more details including interactive diagrams and full exploit analysis.