CVE-2026-20779: Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be...
HIGH
CVSS 7.1
Exploit Available
Published: July 3, 2026 | Last Modified: July 3, 2026
Description
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
Ghostwire Analysis — What This Means Practically
- High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
- Exploit code is reported to be available, increasing the likelihood of active exploitation.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.
Security Coverage (1 articles)
References