Gitea releases before 1.25.5 improperly handle the forwarded‑proto header used to determine public URLs, accepting malformed or injected values. The server can then generate canonical URLs that do not match the real hostname, enabling website owners to display spoofed links that may redirect users to malicious destinations. This flaw is classified as CWE‑284, an improper authorization of URL generation, and can be leveraged for phishing or credential theft attacks.

The vulnerability affects the Gitea Open Source Git Server. All releases dated earlier than version 1.25.5 are vulnerable because they lack the protective logic that sanitizes or ignores forwarded‑proto values from untrusted sources.

An attacker can exploit the flaw by sending HTTP requests that contain a malicious forwarded‑proto header. The attack does not provide code execution or direct system compromise, but it enables deceptive link generation and can mislead users into interacting with phishing sites. The CVSS score of 7.5 indicates a high severity, while the EPSS score of <1 % shows a very low exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog.