CVE-2026-26232 affects Gitea Open Source Git Server versions before 1.25.5. The vulnerability arises because the OAuth2 authorization code flow does not consistently enforce the expiration and single-use constraints of authorization codes during token exchange. This allows an attacker to perform an authentication bypass by capturing and replaying a valid authorization code, potentially gaining unauthorized access. The vulnerability has a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is remotely exploitable without privileges or user interaction and results in high confidentiality and integrity impact.

Successful exploitation can lead to unauthorized access to the Gitea server by bypassing authentication controls. Confidentiality and integrity of the system are highly impacted as attackers may gain access to sensitive repositories or perform unauthorized actions. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.25.5, upgrading to version 1.25.5 or later is recommended once a fix is officially released. Until then, monitor vendor communications for patches or official fixes.