CVE-2026-20779

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-294

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-20788.8A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/upd CVE-2026-207806.5Uncontrolled resource consumption for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a deni CVE-2026-207819.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate CVE-2026-207826.6Buffer overflow for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial o CVE-2026-207836.1Improper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of s CVE-2026-207866.1Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged CVE-2026-207877.4Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of ser CVE-2026-207897.8Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of CVE-2026-20798.8A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addMenu/up CVE-2026-207917.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-207929.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-207933.3Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a d