CVE-2021-45331
published 2022-02-09CVE-2021-45331: An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA…
PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.42%
70.8th percentile
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.5.0 | 1.5.0 |
| code.gitea.io | gitea | >= 1.5.0 < 1.26.3 | 1.26.3 |
| gitea | gitea | < 1.5.0 | 1.5.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
ghsa·2026-07-21·CVSS 9.8
CVE-2026-20779 [CRITICAL] CWE-294 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
### Summary
I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2018 fix (PR #3878) introduced the `TwoFactor.LastUsedPasscode` field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case, but it leaves two follow-up gaps:
1. **A TOCTOU race on the web surfaces (Defect 1).** The read-validate-check-save sequence against the `two_factor` row is not atomic. Two parallel submissions of the same passcode each load their own in-memory copy where `LastUsedPasscode` still holds the prior value; both pass the inequality check, both authenticate, and both then write the same new
OSV
Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
osv·2024-08-21
CVE-2021-45331 Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
GHSA
Reuse of one time passwords allowed in Gitea
ghsa·2022-02-10
CVE-2021-45331 [CRITICAL] CWE-287 Reuse of one time passwords allowed in Gitea
Reuse of one time passwords allowed in Gitea
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
OSV
Reuse of one time passwords allowed in Gitea
osv·2022-02-10
CVE-2021-45331 [CRITICAL] Reuse of one time passwords allowed in Gitea
Reuse of one time passwords allowed in Gitea
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-09
Published