Gitea versions prior to 1.25.5 processed any forwarded-proto header value when a malformed or spoofed forwarded-proto value, causing the server to generate a canonical URL that does not match the real hostname. This flaw enables phishing or misleading link generation and is classified as CWE‑284, an improper authorization of URL generation.

The affected product is the Gitea Open Source Git Server, specifically all releases prior to version 1.25.5. These releases lack proper handling of the forwarded-proto header and are therefore vulnerable to URL spoofing. The vulnerability applies to any intermediate sub-releases that have not adopted protective measures such as stripping or sanitizing forwarded-proto headers coming from untrusted clients.

An attacker could send HTTP requests that contain a malicious forwarded-proto header to trigger the flaw. This does not provide code execution or direct system compromise, but it allows the server to generate a spoofed canonical URL that misleads users or redirects them to malicious content, resulting in phishing or credential theft. The EPSS score of < 1 % indicates a very low exploitation probability, and the vulnerability is not currently listed in CISA KEV.