CVE-2021-45331: Reuse of one time passwords allowed in Gitea
Summary
CVE-2021-45331: Reuse of one time passwords allowed in Gitea. Affects code.gitea.io/gitea versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Also tracked for
- gitea · Bitnami
The same CVE-2021-45331 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, users, and access control. Gitea supports two-factor authentication (2FA) using time-based one-time passwords (TOTP).
Vulnerability Detail
An Authentication Bypass vulnerability exists in Gitea before version 1.5.0. This vulnerability allows a malicious user to gain privileges by reusing a captured TOTP code for 2FA. Normally, TOTP codes are meant to be used only once, but in this case, the code can be submitted correctly multiple times. This bypasses the intended security measures and allows unauthorized access to the system.
How To Fix
Latest published version: v1.26.4 as of 22 Oct 2026
go get code.gitea.io/gitea@v1.26.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
go get code.gitea.io/gitea@v1.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
Conclusion
The Authentication Bypass vulnerability in Gitea before version 1.5.0 allows malicious users to gain unauthorized access to the system. It is crucial to upgrade to the fixed version to ensure the security of your repositories and user accounts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for code.gitea.io/gitea →
FAQ
Gitea is an open-source self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, users, and access control.
This vulnerability allows a malicious user to bypass the authentication process and gain unauthorized access to the system. They can potentially perform actions on behalf of other users, access sensitive information, or modify repositories.
To fix this vulnerability, you should upgrade your Gitea installation to version 1.5.0 or later. This version includes a fix for the authentication bypass issue.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
You can find more information about this vulnerability in the official Gitea advisory: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for code.gitea.io/gitea.
