PT-2026-63285 · Go · Code.Gitea.Io/Gitea
CVE-2026-56750
·
Publicado
2026-07-21
·
Atualizado
2026-07-21
CVSS v4.0
9.1
Crítica
| Vetor | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
The vulnerability is in the Remember-Me (gitea incredible) token validation logic, specifically when handling a compromised token (hash mismatch).
The vulnerable function is this one:
https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth token.go#L33-L64
Affected Endpoint
POST
/user/login (and any endpoint triggering autoSignIn via the Remember-Me cookie).Description
Gitea implements Remember-Me cookies using a split token design (ID:Hash), [citing the Paragonie secure remember-me guide](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth token.go#L21). When a token is used, its Hash is rotated, but the ID remains the same.
If an attacker steals a user's Remember-Me token and uses it to authenticate, the attacker is issued a new rotated token (same ID, new Hash). When the legitimate user later attempts to use their original token, Gitea correctly detects a hash mismatch for the given ID.
According to the referenced Paragonie specification, this indicates a compromised token, and ALL active remember-me sessions for that user MUST be invalidated. However, Gitea's
CheckAuthToken function simply returns ErrAuthTokenInvalidHash. The calling code (autoSignIn) catches this error and deletes the victim's local cookie via ctx.DeleteSiteCookie, but fails to delete the compromised token from the database.As a result, the attacker's active session is never invalidated, and the attacker maintains persistent, indefinite access to the victim's account, entirely defeating the purpose of the split-token security design.
Correção
Insufficient Session Expiration
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Code.Gitea.Io/Gitea