SUSE CVE-2026-26247

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

GO-2026-6342 Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea

Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea...

CVE-2026-67336

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...

Gitea OAuth2 PKCE S256 verifier bypass

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

CVE-2026-26247: Improper Access Control

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...