{"id":"CVE-2026-101023","published":"2026-10-06T22:16:59Z","modified":"2026-10-13T14:39:07Z","title":"Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant…","vendor":"Gitea","product":"Gitea","tier":"core","eol":null,"description":{"text":"Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.","provenance":"source","from":"NVD"},"summary":{"text":"Gitea's OAuth2 token endpoint fails to verify that a token submitted under the refresh_token grant type is actually a refresh token, accepting any valid signed token from the same OAuth2 application and grant. An attacker holding an unexpired access token for that application and grant, reachable over the network without authentication or user interaction, can exchange it for a new access token and refresh token, extending their access beyond the original token's lifetime.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:29Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.00353,"percentile":0.28937,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ace466c18a71dd7afa3f788","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6accf723f346ce4b8a50d55a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6acba8a68a86c4d9508005a7","created":"2026-10-11"},{"name":"Known_Cve | Oct 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6aca554665c47eb24716f8f2","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac90361476f45b4b982597d","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac7b1a3f215e7af4290dc2e","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac65e5b607642608f852c9a","created":"2026-10-07"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3","tags":["Vendor Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-94061","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94061","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101023","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.79,"detail":"percentile 0.2894"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}