CVE-2026-56750 — Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Affected: Gitea Open Source Git Server

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

GHSA-rgv6-xp99-6mgj — Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Affected: Go: code.gitea.io/gitea

The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).

The vulnerable function is this one:

https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64

### Affected Endpoint POST `/user/login` (and any endpoint triggering `autoSignIn` via the Remember-Me cookie).

### Description Gitea implements Remember-Me cookies using a split token design (ID:Hash), [citing the Paragonie secure remember-me guide](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L21). When a token is used, its Hash is rotated, but the ID remains the same.

If an attacker steals a user's Remember-Me token and uses it to authenticate, the attacker is issued a new rotated token (same ID, new Hash). When the legitimate user later attempts to use their original token, Gitea correctly detects a hash mismatch for the given ID.

According to the referenced Paragonie specification, this indicates a compromised token, and ALL active remember-me sessions for that user MUST be invalidated. However, Gitea's `CheckAuthToken` function simply returns `ErrAuthTokenInvalidHash`. The calling code (`autoSignIn`) catches this error and deletes the victim's local cookie via `ctx.DeleteSiteCookie`, but fails to delete the compromised token from the database.

As a result, the attacker's active session is never invalidated…

Most recent entries from all

CVE-2026-56750 — Gitea Remember-Me Token Theft Not Invalidating Attacker Session

GHSA-rgv6-xp99-6mgj — Gitea Remember-Me Token Theft Not Invalidating Attacker Session