Gitea versions before 1.25.5 allow OAuth2 authorization codes to be used more than once and do not enforce an expiration time (this is a flaw mapped to CWE‑294). As a result, a valid authorization code can be exchanged for an access token repeatedly, and the code can be used at any time after issuance unless it is manually revoked. The consequence is that an attacker who obtains a legitimate code—through phishing, interception, or a compromised client—could use it to obtain an access token that grants unauthorized access to the victim’s resources.

All deployments of Gitea Open Source Git Server running a version earlier than 1.25.5 are affected. The advisory does not specify conditional limitations on operating system, network topology, or hosting environment, implying that every instance of the vulnerable application is potentially exploitable regardless of underlying infrastructure.

The CVSS score of 9.1 indicates critical severity. The EPSS score of <1% indicates that wild exploitation is unlikely, yet the flaw remains significant for targeted attacks. The vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could exploit the lack of single-use enforcement during the OAuth2 token exchange step to obtain a long‑lived access token. Such a token could then be used to access resources under the victim’s account. The exact likelihood of exploitation depends on the attacker’s ability to acquire a valid authorization code, which is not detailed in the CVE data.