Description

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T17:17:25.577Z",
  "pubdate": "2026-08-13T17:17:25.577Z",
  "executiveSummary": "A vulnerability exists in Gitea where the 'Remember-Me' token theft does not properly invalidate an existing attacker session.\nThis security flaw involves improper session management and session invalidation logic within the authentication subsystem.\nThe primary impact of this vulnerability is unauthorized session persistence, allowing an adversary who has compromised or stolen a 'Remember-Me' token to maintain access even after mitigation actions or token invalidation procedures are initiated.\nThe affected product is Gitea.\nThe risk implications include unauthorized access to user accounts, potential repository compromise, and data exfiltration.\nAttacker capabilities involve leveraging a compromised persistent authentication token to bypass standard session termination controls.\nExploitation requires the acquisition of a valid 'Remember-Me' token through prior compromise vectors such as network sniffing, cross-site scripting, or database access.",
  "technicalDetails": "The root cause of this vulnerability lies in the session management implementation of Gitea, specifically within the handling and lifecycle enforcement of persistent 'Remember-Me' authentication tokens.\nWhen a 'Remember-Me' token is revoked, compromised, or explicitly targeted for invalidation, the underlying session associated with the token is not adequately terminated or invalidated on the server side.\nThe vulnerable component resides in the authentication and session management modules responsible for processing persistent login cookies and correlating them with active server-side sessions.\nThe attack flow begins when an attacker obtains a victim's valid 'Remember-Me' token. Upon utilizing this token, a session is established.\nIf the token is subsequently flagged, reported as stolen, or invalidated by the user or system administrator, the associated active attacker session remains valid and operational instead of being immediately destroyed.\nConsequently, the attacker retains persistent, unauthorized access to the Gitea instance and the victim's account privileges.\nThe exploitation method relies on the desynchronization between persistent token revocation states and active server-side session states.\nAuthentication requirements for the initial token acquisition depend on external vectors, but exploitation of the flaw itself requires presenting the persistent authentication token.\nPrivilege requirements depend on the victim's account privileges, potentially ranging from standard repository access to administrative control if an administrator's token is targeted.\nThe network exposure includes any interface where Gitea processes HTTP requests containing authentication cookies or persistent tokens.\nPost-exploitation impact includes unauthorized code modification, access to private repositories, leakage of sensitive environment secrets, and potential lateral movement within the development infrastructure."
}