CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CVE-2026-55987

The software Gitea is vulnerable to an incorrect authorization flaw where an OAuth2 sign-in reactivates an account that was previously deactivated by an administrator on authentication sources, specifically when refresh tokens are not used. This issue is an incomplete fix for bug #38009. Exploita...

CVE-2026-55987

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:27+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-vrhc-jjfc-m3m3...