CVE-2026-109553

The Gitea SSH server is vulnerable to principal impersonation due to an incorrect logic in how it resolves SSH certificate principals. The software incorrectly searches the content of all stored public keys instead of only the principal keys. This issue occurs when Gitea trusts a user certificate...