Gitea: OAuth2 refresh token grant accepts access tokens
Summary
Gitea's OAuth2 token endpoint does not check that a token submitted with the refresh_token grant type is actually a refresh token. An attacker holding an unexpired access token for the same OAuth2 application and grant can exchange it for a new access token and refresh token. This allows access to continue beyond the original lifetime of the access token.
Affected
- Gitea versions 0 to 28.0.0 (inclusive)
Fixed in
- Gitea 28.1.0 (fix in pull requests #39501 and #39507)
Workaround
Unknown.
Exploitation
- Not listed as known exploited (not in CISA KEV).
- No public proof of concept found at the time of writing.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Upgrade Gitea to 28.1.0 or later as soon as possible.
- Review registered OAuth2 applications and restrict who can use them.
- Revoke tokens issued before the upgrade so that stale access tokens stop working.
- Review OAuth2 tokens and integrations for unusual activity.
- Note that the attacker first needs a valid access token, which reduces the practical risk compared with the CVSS score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea release 28.1.0 blog blog.gitea.com
- GitHub Security Advisory GHSA-469m-x4mw-38r3 github.com
- Gitea release v28.1.0 github.com
- Fix pull request #39501 github.com
- Fix pull request #39507 github.com
- OSV BIT-gitea-2026-101023 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:21.
Original description (NVD)
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.