GitHub Advisoryadvisory · Go

GHSA-pc73-rj2c-wvf9 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists

MEDIUM Published 2026-01-01 Modified 2026-01-02 Official page ↗

Aliases: CVE-2025-69413
Ecosystem: Go
Packages: code.gitea.io/gitea
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-204
Reviewed: 2026-01-02

Affected packages

• Go code.gitea.io/gitea: < 1.25.2 → fixed in 1.25.2

Description

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

Related

Alias · CVE (1)

CVE-2025-69413 In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. vulnerability

Weakness · CWE (1)

CWE-204 Observable Response Discrepancy weakness

References