CVE-2026-56750
published 2026-08-13CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session
PriorityP351critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.34%
27.4th percentile
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-opc-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-cli-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
code.gitea.io/gitea: Gitea: Unauthorized access due to remember-me token theft not invalidating attacker sessions.
vendor_redhat·2026-08-13·CVSS 9.1
CVE-2026-56750 [CRITICAL] CWE-613 code.gitea.io/gitea: Gitea: Unauthorized access due to remember-me token theft not invalidating attacker sessions.
code.gitea.io/gitea: Gitea: Unauthorized access due to remember-me token theft not invalidating attacker sessions.
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability can lead to persistent unauthorized access and potential compromise of user data.
Statement: An Important flaw exists in Gitea where the theft of a 'remember-me' token does not invalidate an attacker's session. This allows an attacker to retain unauthorized access to a user's account even after the legitimate user has log
GHSA
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
ghsa·2026-07-21
CVE-2026-56750 [CRITICAL] CWE-613 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).
The vulnerable function is this one:
https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64
### Affected Endpoint
POST `/user/login` (and any endpoint triggering `autoSignIn` via the Remember-Me cookie).
### Description
Gitea implements Remember-Me cookies using a split token design (ID:Hash), [citing the Paragonie secure remember-me guide](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L21). When a token is used, its Hash is rotated, but the ID remains the
No detection rules found.
No public exploits indexed.
2026-08-13
Published