https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:20:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352878 EUVD-2026-352878 https://cve.radiocsirt.org/vuln/euvd-2026-352878 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56750 <p>Gitea Remember-Me Token Theft Not Invalidating Attacker Session</p> <p>Gitea Remember-Me Token Theft Not Invalidating Attacker Session</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56750 https://cve.radiocsirt.org/vuln/ghsa-rgv6-xp99-6mgj <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).</p> <p>The vulnerable function is this one:</p> <p>https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64</p> <p>### Affected Endpoint POST `/user/login` (and any endpoint triggering `autoSignIn` via the Remember-Me cookie).</p> <p>### Description Gitea implements Remember-Me cookies using a split token design (ID:Hash), [citing the Paragonie secure remember-me guide](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L21). When a token is used, its Hash is rotated, but the ID remains the same.</p> <p>If an attacker steals a user&#39;s Remember-Me token and uses it to authenticate, the attacker is issued a new rotated token (same ID, new Hash). When the legitimate user later attempts to use their original token, Gitea correctly detects a hash mismatch for the given ID.</p> <p>According to the referenced Paragonie specification, this indicates a compromised token, and ALL active remember-me sessions for that user MUST be invalidated. However, Gitea&#39;s `CheckAuthToken` function simply returns `ErrAuthTokenInvalidHash`. The calling code (`autoSignIn`) catches this error and deletes the victim&#39;s local cookie via `ctx.DeleteSiteCookie`, but fails to delete the compromised token from the database.</p> <p>As a result, the attacker&#39;s active session is never invalidated…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).</p> <p>The vulnerable function is this one:</p> <p>https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64</p> <p>### Affected Endpoint POST `/user/login` (and any endpoint triggering `autoSignIn` via the Remember-Me cookie).</p> <p>### Description Gitea implements Remember-Me cookies using a split token design (ID:Hash), [citing the Paragonie secure remember-me guide](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L21). When a token is used, its Hash is rotated, but the ID remains the same.</p> <p>If an attacker steals a user&#39;s Remember-Me token and uses it to authenticate, the attacker is issued a new rotated token (same ID, new Hash). When the legitimate user later attempts to use their original token, Gitea correctly detects a hash mismatch for the given ID.</p> <p>According to the referenced Paragonie specification, this indicates a compromised token, and ALL active remember-me sessions for that user MUST be invalidated. However, Gitea&#39;s `CheckAuthToken` function simply returns `ErrAuthTokenInvalidHash`. The calling code (`autoSignIn`) catches this error and deletes the victim&#39;s local cookie via `ctx.DeleteSiteCookie`, but fails to delete the compromised token from the database.</p> <p>As a result, the attacker&#39;s active session is never invalidated…</p> https://cve.radiocsirt.org/vuln/ghsa-rgv6-xp99-6mgj https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304