CVE-2026-20779 Gitea CVE debrief

Who should care

Administrators and users of Gitea instances, especially those using two-factor authentication with TOTP, should be aware of this vulnerability. If an attacker gains access to a user's TOTP code, they could exploit this defect to bypass two-factor authentication multiple times.

Technical summary

The TOTP single-use enforcement defect in Gitea allows an attacker to reuse a valid TOTP code more than once. This could happen across different authentication flows, such as web-based two-factor authentication and Basic Auth with X-Gitea-OTP. The vulnerability exists in Gitea versions from 1.5.0 up to but not including 1.26.3. The Common Vulnerabilities and Exposures (CVE) score for this vulnerability is 7.1, classified as HIGH severity.

Defensive priority

High priority should be given to updating Gitea instances to version 1.26.3 or later. In the meantime, additional monitoring and logging of authentication attempts, especially those involving TOTP codes, may help detect potential exploitation attempts.

Recommended defensive actions

• Update Gitea to version 1.26.3 or later
• Review and enhance authentication logging and monitoring
• Consider implementing additional security measures for two-factor authentication
• Confirm whether affected Gitea instances exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-03T21:16:56.543Z and was last modified on 2026-07-07T18:16:35.270Z. The NVD entry is currently Deferred. Multiple sources confirm the vulnerability, including the official Gitea release notes and GitHub advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.