The vulnerability (CVE-2026-56750) affects Gitea's Remember-Me token mechanism, which uses a split token design (ID and Hash). Upon token use, the hash is rotated but the ID remains the same. If an attacker steals a token and authenticates, they receive a new rotated token. When the legitimate user later uses their original token, Gitea detects a hash mismatch indicating compromise. According to the Paragonie specification, all active Remember-Me sessions should then be invalidated. However, Gitea's implementation only deletes the victim's local cookie and does not remove the compromised token from the database, allowing the attacker to retain persistent access indefinitely. This flaw is present in versions before 1.27.0.

An attacker who steals a user's Remember-Me token can maintain persistent, indefinite access to the victim's account because the compromised token is not invalidated in the backend. This undermines the security model of the Remember-Me feature and allows unauthorized session persistence despite detection of token compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Remember-Me feature or monitoring for suspicious session activity. The vendor advisory or repository should be monitored for updates addressing this vulnerability.