Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
为什么是这个 VPI(可解释·实验性)
VPI 计算依据
| 影响度 | 91.00 |
| 利用信号(无额外利用信号) | ×1.00 |
| VPI | 91.00 |
VPI 公式 vpi-v1