Gitea uses a remember‑me cookie to keep users logged in across browser sessions. If an attacker obtains this cookie, they can start a session as the legitimate user. The application does not invalidate a stolen cookie when the real user logs out or changes their credentials, allowing the attacker to keep the malicious session active without further authentication steps.

The vulnerability affects all instances of Gitea Open Source Git Server that run before the 1.27.0 release, as the token‑invalidation fix is only present in that version and later. Until the fix is applied, any deployment could be impacted.

The CVSS score of 9.1 indicates critical severity, while the EPSS score of < 1% suggests a low probability of exploitation. The flaw provides an authentication bypass. The likely attack vector involves acquiring the remember‑me cookie through phishing, credential theft, or other side‑channel methods; once the attacker holds the cookie, they can reuse it from any remote location. The issue is not listed in the CISA KEV catalog.