GHSA-pc73-rj2c-wvf9MediumCVSS 5.3

Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists

Published
January 1, 2026
Last Modified
January 2, 2026

🔗 CVE IDs covered (1)

CVE-2025-69413 →

📋 Description

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

🎯 Affected products1

  • go/code.gitea.io/gitea:< 1.25.2

🔗 References (6)