CVE-2021-45331: Gitea

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.

Affected products

• Gitea Gitea: before 1.5.0 (fixed in 1.5.0)

Published 2022-02-09. Last modified 2026-06-17.