When the built‑in SSH server in Gitea is active, the system resolves a client’s public key using an SQL LIKE comparison of the encoded key. On databases such as SQLite, LIKE is case‑insensitive, so an attacker who can create a case variation of a victim’s registered RSA public key can cause that key to be matched to the victim’s account. Because the key is then accepted for authentication, the attacker can assume the victim’s identity over SSH. The flaw therefore allows unauthorized SSH login and any actions that the legitimate user can perform, undermining confidentiality and integrity. This is an example of CWE-178 (Improper Case Folding) and CWE-305 (Improper Restriction of Access to a Resource).

The vulnerability affects Gitea installations that enable the built‑in SSH server (START_SSH_SERVER = true). Any release prior to the change in 28.0.0, which increased key lookup to fingerprint comparison, is susceptible. No version scope is explicitly listed.

Exploitation requires an attacker who can generate a case‑variant of a target’s public key and also derive the matching private key. In practice, this means the attacker already possesses the victim’s private key, in which case the vulnerability simply provides a convenient authentication shortcut. The attack vector is remote, operating over the standard SSH connection, and does not require local privilege escalation or additional services. The CVSS score of 9.1 indicates critical severity, but the EPSS score of less than 1% shows a very low estimation of exploitation probability. The vulnerability is not currently listed in CISA’s KEV catalog.