The flaw in Gitea causes the PKCE S256 challenge method to be omitted from the token exchange phase, allowing an attacker to exchange an authorization code for a valid access token without providing the required verifier, thereby facilitating unauthorized access or impersonation of a user. This weakness is a classic example of Improper Authorization (CWE‑284) and directly undermines the security guarantees of OAuth2 when PKCE is expected to be enforced.

All versions of Gitea Open Source Git Server released prior to 1.25.5, including the common community edition, are affected.

With a CVSS score of 9.1, the vulnerability presents a severe risk; the EPSS score of less than 1% signals a low likelihood of exploitation by widespread threat actors, and it is not listed in the CISA KEV catalog. The attack vector is likely remote via the exposed OAuth2 endpoints, where an adversary controlling the client side may initiate the authorization flow and then redeem the code for an access token without needing the verifier, effectively bypassing PKCE protection.