{"vulnerability": "cve-2026-2077", "sightings": [{"uuid": "67eed0c0-564e-46af-9fa7-12192118e8f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20777", "type": "seen", "source": "https://infosec.place/objects/920ca239-3e6d-45b4-bc4a-e5c1b5040806", "content": "", "creation_timestamp": "2026-03-03T15:30:06.094774Z"}, {"uuid": "2586023e-e8e9-4748-8063-ce9a1d176ab3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20777", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg63xlwitz26", "content": "", "creation_timestamp": "2026-03-03T15:37:30.147076Z"}, {"uuid": "43d8acd6-d2e6-42c1-8beb-634af011ba8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20777", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg66m4gwp227", "content": "", "creation_timestamp": "2026-03-03T16:24:45.264594Z"}, {"uuid": "eb8a128c-eaf2-40e2-8335-4636943b9cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20777", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgdkhfcbv72w", "content": "", "creation_timestamp": "2026-03-05T19:40:10.462194Z"}, {"uuid": "88f60bd5-f2bb-48d6-b3e3-17ac13a5b3c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20777", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-010/", "content": "", "creation_timestamp": "2026-03-09T00:00:00.000000Z"}, {"uuid": "c62202e7-607e-44e3-9cd6-c250d0641aff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20779", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpt7vnjjtz2p", "content": "CVE-2026-20779 - Supply chain attack risk in Gitea. TOTP reuse flaw bypasses 2FA. CVSS 7.1. Update to 1.26.3 or later immediately. #CVE #Gitea #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-20779/", "creation_timestamp": "2026-07-04T14:00:38.005110Z"}, {"uuid": "3d38954f-42ab-40ac-a4cd-bec4a4b48702", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20779", "type": "published-proof-of-concept", "source": "https://github.com/go-gitea/gitea/security/advisories/GHSA-gx3v-q759-g323", "content": "", "creation_timestamp": "2026-07-21T22:35:02.868621Z"}, {"uuid": "1717ff20-7e5a-49d4-bfc6-45e1b6d0c799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20779", "type": "seen", "source": "https://gist.github.com/alon710/858227db9dfcc3f8ab3390f0832100c1", "content": "# CVE-2026-20779: CVE-2026-20779: TOTP Single-Use Enforcement Defect in Gitea\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-07-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-20779\n\n## Summary\nGitea versions from 1.5.0 before 1.26.3 contain a security vulnerability in their multi-factor authentication (MFA) logic. This vulnerability allows valid TOTP codes to be accepted multiple times across web authentication flows and the Basic Auth X-Gitea-OTP header path. Due to a TOCTOU race condition and a lack of state tracking in programmatic auth pathways, attackers with valid credentials can replay single-use OTP codes.\n\n## TL;DR\nA high-severity authentication bypass in Gitea allows attackers to replay TOTP codes across web and API paths due to database race conditions and missing state tracking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-294 (Bypass of Authentication Mechanism Using Replay)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.1 (High)\n- **EPSS Score**: 0.00481 (Percentile: 38.44%)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n- **Affected Versions**: v1.5.0 to < v1.26.3\n\n## Affected Systems\n\n- Gitea Open Source Git Server\n\n## Mitigation\n\n- Upgrade Gitea to version 1.26.3 or higher immediately.\n- Restrict or disable password-based basic authentication over HTTP/HTTPS in favor of SSH keys.\n- Implement rate-limiting on authentication endpoints (/user/two_factor and API endpoints) at the reverse proxy layer.\n\n**Remediation Steps:**\n1. Step 1: Identify all running Gitea instances and verify their versions.\n2. Step 2: Back up the Gitea database and configuration files (app.ini).\n3. Step 3: Deploy the updated Gitea binary or container image (v1.26.3 or later).\n4. Step 4: Verify the TOTP single-use policy by attempting a replay of a used OTP on the user/two_factor interface.\n\n## References\n\n- [Gitea v1.26.3 Release Tag](https://github.com/go-gitea/gitea/releases/tag/v1.26.3)\n- [Gitea v1.26.3 and v1.26.4 Security Release Blog](https://blog.gitea.com/release-of-1.26.3-and-1.26.4/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-20779) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-22T10:31:09.924407Z"}]}