CVE-2026-25779: Gitea Open Redirect via Backslash Bypass (CVSS 6.1)

Technical summary

CVE-2026-25779 is an open redirect vulnerability stemming from insufficient validation of the redirect_to parameter in Gitea's redirect handling logic. The application fails to properly sanitize backslash characters—both literal (\) and percent-encoded (%5C)—allowing an attacker to craft a URL that bypasses the redirect allowlist. When a user clicks a malicious link containing an encoded backslash, the redirect validation logic treats the subsequent domain as part of the local path structure rather than an external redirect, permitting the bypass. The root cause falls under CWE-601 (URL Redirection to Untrusted Site / Open Redirect).

Business impact

Open redirects in authentication workflows pose a significant trust and credential risk. Users completing a legitimate login flow may be seamlessly redirected to an attacker-controlled domain that mimics the Gitea login page, facilitating credential harvesting without user awareness of the deception. Organizations running Gitea for internal development collaboration face phishing exposure, particularly if users are accustomed to following redirects after authentication. Attackers can also leverage this in supply chain scenarios where Gitea instances host shared repositories and developers follow redirects embedded in documentation or repository metadata.

Affected systems

Gitea versions up to and including 1.25.4 are confirmed vulnerable. Any deployment running these versions—whether on-premises or cloud-hosted—requires attention. Organizations should verify their Gitea version via the admin console or by checking the version string in HTTP response headers or the web interface footer.

Exploitability

This vulnerability requires user interaction (UIR requirement in CVSS vector) but is otherwise straightforward to exploit. An attacker crafts a Gitea login URL with a malicious redirect_to parameter using backslash encoding, then tricks a user into clicking the link via email, chat, or social engineering. No authentication or special privileges are required to craft the malicious URL. The attack surface is broad because login pages are typically public-facing. However, the redirect bypass only succeeds if the user follows the link, making social engineering a prerequisite.

Remediation

Upgrade Gitea to a patched version released after July 2026 that properly validates and sanitizes redirect_to parameters, rejecting or normalizing backslash characters before validation logic. Verify the specific patched version number in the official Gitea security advisory. Additionally, organizations can implement a Web Application Firewall (WAF) rule to block requests with percent-encoded backslashes (%5C) in redirect_to parameters as a temporary mitigation.

Patch guidance

Check the official Gitea GitHub releases page and security advisories for the specific patched version addressing CVE-2026-25779. Apply the patch immediately upon availability. For air-gapped environments, coordinate a maintenance window to deploy the update after verifying compatibility with any local customizations. Test in a staging instance first, particularly if you have custom authentication integrations.

Detection guidance

Monitor access logs for suspicious redirect_to parameters containing encoded backslashes (look for %5C patterns). Review HTTP referrer logs to identify any redirects to external domains following Gitea login pages. Implement a WAF or reverse proxy rule to alert on or block requests with encoded backslashes in redirect parameters. Check browser history and access logs of development team members for unexpected redirects following Gitea logins.

Why prioritize this

Although rated MEDIUM (CVSS 6.1) and not yet on the KEV catalog, this vulnerability merits prompt remediation because it directly targets authentication workflows and enables credential theft with minimal attacker effort. Organizations should prioritize patching over lower-severity issues, particularly if Gitea is internet-facing or used by external collaborators. The exploitation barrier is low relative to the trust impact.

Risk score, explained

CVSS 6.1 reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and the requirement for user interaction (UI:R). The impact is limited to low confidentiality and integrity loss (C:L/I:L) with no availability impact (A:N), and the scope change (S:C) allows the attack to affect resources beyond the vulnerable component. The score is elevated by network exposure and ease of exploitation, but constrained by the UI requirement and modest impact.

Frequently asked questions