The vulnerability is an OAuth2 token endpoint flaw that accepts any unexpired access token as a refresh token because the endpoint does not verify the token type. This permits an attacker who already holds a valid access token to repeatedly exchange it for fresh access and refresh tokens, thereby extending the authenticated session far beyond the original expiry. The weakness is a combination of token type validation failure and improper token handling (CWE-1287, CWE-287).

The flaw is present in Gitea's OAuth2 implementation. The CVE references a fix in the 28.1.0 release, but the CVE data does not specify an affected-version range; consequently, the exact scope of vulnerable releases is uncertain. Administrators should assume that all Gitea deployments that have not applied the latest security patch may be susceptible until the fix is applied.

A valid token for a given OAuth2 application is enough to carry out the attack. The attacker issues a standard token-refresh request, the server accepts it, and supplies new tokens. The CVSS score of 9.1 indicates critical severity. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a legitimate web request to the "/oauth/token" endpoint, and the exploit requires no special privileges beyond a stolen or legitimate access token.