Bug 2547224 (CVE-2026-101023)

Summary: CVE-2026-101023 code.gitea.io/gitea: Gitea: Prolonged access via improper OAuth2 token type validation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gbenhaim, niyer, twaugh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Gitea. The OAuth2 (Open Authorization) token endpoint validates the signature and grant of a token during a refresh request, but fails to confirm that the submitted token is specifically a refresh token. An attacker or user possessing a valid, unexpired access token can exchange it for a new access token and refresh token. This allows unauthorized actors to maintain persistent access to the application beyond the original token's intended expiration time.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-06 21:52:18 UTC 
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.