CVE-2025-69413

Description

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

PUBLISHED Reserved 2026-01-01 | Published 2026-01-01 | Updated 2026-01-01 | Assigner mitre

Problem types

CWE-204 Observable Response Discrepancy

Product status

References

blog.gitea.com/release-of-1.25.2/

github.com/go-gitea/gitea/releases/tag/v1.25.2

github.com/go-gitea/gitea/issues/35984

github.com/go-gitea/gitea/pull/36002

cve.org (CVE-2025-69413)

nvd.nist.gov (CVE-2025-69413)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.