CVE-2026-123002

not scored yet · published 2026-11-15

Gitea accepted an unlimited number of wrong TOTP passcodes during sign-in, in the password reset flow and for Basic authentication with the `X-Gitea-OTP` header. An attacker who already knows an account's password could guess the six-digit passcode by trying codes at a high rate and sign in despite two-factor authentication. After five failed passcodes, further attempts for the account are now refused for 15 minutes.

Weakness: CWE-307

Source: NVD CVE-2026-123002

References

• https://blog.gitea.com/release-of-28.4.0/
• https://github.com/go-gitea/gitea/pull/39993
• https://github.com/go-gitea/gitea/pull/40374
• https://github.com/go-gitea/gitea/releases/tag/v28.4.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-5mx6-8rwm-52wf

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.