CVE-2026-26247 affects Gitea Open Source Git Server versions before 1.25.5. The issue arises because the OAuth2 PKCE S256 challenge method is not properly persisted during the authorization process, which allows token exchange without verifying the expected code verifier. This improper access control weakness (CWE-284) can lead to unauthorized token issuance, compromising confidentiality and integrity of user sessions. The vulnerability has a CVSS v3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation of this vulnerability allows an attacker to bypass the OAuth2 PKCE verifier check and obtain access tokens without proper authorization. This can lead to unauthorized access to user accounts and sensitive repository data, compromising confidentiality and integrity. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor Gitea's official channels for updates and apply the patch once available. Until then, consider restricting OAuth2 token exchanges or applying compensating controls to limit exposure.