{"uuid": "1717ff20-7e5a-49d4-bfc6-45e1b6d0c799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20779", "type": "seen", "source": "https://gist.github.com/alon710/858227db9dfcc3f8ab3390f0832100c1", "content": "# CVE-2026-20779: CVE-2026-20779: TOTP Single-Use Enforcement Defect in Gitea\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-07-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-20779\n\n## Summary\nGitea versions from 1.5.0 before 1.26.3 contain a security vulnerability in their multi-factor authentication (MFA) logic. This vulnerability allows valid TOTP codes to be accepted multiple times across web authentication flows and the Basic Auth X-Gitea-OTP header path. Due to a TOCTOU race condition and a lack of state tracking in programmatic auth pathways, attackers with valid credentials can replay single-use OTP codes.\n\n## TL;DR\nA high-severity authentication bypass in Gitea allows attackers to replay TOTP codes across web and API paths due to database race conditions and missing state tracking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-294 (Bypass of Authentication Mechanism Using Replay)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.1 (High)\n- **EPSS Score**: 0.00481 (Percentile: 38.44%)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n- **Affected Versions**: v1.5.0 to < v1.26.3\n\n## Affected Systems\n\n- Gitea Open Source Git Server\n\n## Mitigation\n\n- Upgrade Gitea to version 1.26.3 or higher immediately.\n- Restrict or disable password-based basic authentication over HTTP/HTTPS in favor of SSH keys.\n- Implement rate-limiting on authentication endpoints (/user/two_factor and API endpoints) at the reverse proxy layer.\n\n**Remediation Steps:**\n1. Step 1: Identify all running Gitea instances and verify their versions.\n2. Step 2: Back up the Gitea database and configuration files (app.ini).\n3. Step 3: Deploy the updated Gitea binary or container image (v1.26.3 or later).\n4. Step 4: Verify the TOTP single-use policy by attempting a replay of a used OTP on the user/two_factor interface.\n\n## References\n\n- [Gitea v1.26.3 Release Tag](https://github.com/go-gitea/gitea/releases/tag/v1.26.3)\n- [Gitea v1.26.3 and v1.26.4 Security Release Blog](https://blog.gitea.com/release-of-1.26.3-and-1.26.4/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-20779) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-22T10:31:09.924407Z"}