Gitea versions from 1.5.0 through before 1.26.3 contain a flaw in the two‑factor authentication logic that permits a valid TOTP code to be accepted more than once. The single‑use rule normally enforces that one‑time passwords cannot be reused, so the defect allows an attacker to replay a captured OTP. This improper authentication weakness (CWE‑294) can lead to unauthorized authentication and the subsequent ability to access repository data available to the authenticated user.

The vulnerability affects the Gitea open‑source Git server, including all releases from 1.5.0 up to but not including 1.26.3. It manifests in both the web‑based two‑factor login flow and the Basic Authentication X‑Gitea‑OTP header. Systems running any unpatched version with active user accounts are at risk.

The CVSS score of 7.1 indicates a high severity issue. The EPSS score of <1% reflects a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector (inferred) is that an attacker who intercepts a legitimate OTP during a login or API request can replay it before expiration to bypass the single‑use enforcement. If such a replay occurs, the attacker could gain authenticated access and perform any actions that the legitimate user is permitted to carry out.