OAuth2 Sign-In Issue in Gitea Affects Deactivated Accounts

CVE-2026-55987

What is CVE-2026-55987?

The OAuth2 sign-in process in Gitea inadvertently reactivates user accounts that administrators have deactivated, compromising intended security measures. This issue occurs when using certain authentication sources that don't require refresh tokens, leading to incomplete deactivation. Organizations using Gitea should take caution to ensure that sensitive accounts remain secure and monitor for unintended access through this vulnerability.

References