CVE-2026-20779 affects Gitea Open Source Git Server versions starting from 1.5.0 before 1.26.3. The vulnerability arises from improper enforcement of single-use TOTP codes, permitting reuse of a valid TOTP code across authentication flows including web two-factor authentication and Basic Auth X-Gitea-OTP. This weakness can lead to partial compromise of authentication integrity, allowing an attacker to bypass intended one-time code restrictions. The CVSS vector indicates the attack requires network access, no privileges, user interaction, and results in high confidentiality impact with limited integrity impact and no availability impact.

The vulnerability allows reuse of valid TOTP codes, potentially enabling attackers to bypass two-factor authentication protections partially. This compromises the confidentiality of accounts protected by TOTP in affected Gitea versions. Integrity impact is limited, and availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor Gitea's official advisories for updates and apply any forthcoming patches promptly. Until a fix is available, consider additional compensating controls for two-factor authentication mechanisms.