CVE-2026-20779 affects Gitea versions starting from 1.5.0 before 1.26.3. The vulnerability is a defect in the enforcement of single-use Time-based One-Time Passwords (TOTP) during two-factor authentication flows, including both web and Basic Auth X-Gitea-OTP methods. Due to this defect, a valid TOTP code can be accepted more than once, which undermines the intended security of the two-factor authentication mechanism. This issue is categorized under CWE-294 (Improper Authentication). No official patch or remediation level has been provided in the available data, and no known exploits in the wild have been reported.

The vulnerability allows reuse of a valid TOTP code, which can reduce the effectiveness of two-factor authentication by permitting multiple authentications with the same one-time code. This could lead to unauthorized access if an attacker obtains a valid TOTP code and reuses it within the affected authentication flows. The confidentiality impact is high, while integrity impact is low and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided in the available data, users should monitor Gitea's official channels for updates. Until a fix is available, consider additional compensating controls around authentication processes to mitigate risk.