CVE-2022-1058: Gitea login open redirect allows credential phishing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe CVSS score is 6.1 (medium) and exploitation requires user interaction, but high EPSS and a public exploit reference raise the practical risk.

What it is

Gitea before 1.16.5 contains an open redirect on the login flow (CWE-601). An attacker can craft a login URL that sends the victim to an arbitrary external site after authentication, which is useful for phishing and credential theft. The flaw is network-reachable and requires the victim to click a link, but no attacker authentication is needed.

Impact

An attacker gains the ability to redirect a victim from a trusted Gitea login page to an attacker-controlled site, enabling convincing phishing or malware delivery. There is no direct code execution or data disclosure from the redirect itself.

Attack surface

Reached over the network via a crafted login URL; the CVSS vector shows PR:N and UI:R, so no authentication is required but the victim must interact with the link. The redirect is triggered during the login process.

Exploitation

Not listed in CISA KEV, but EPSS is 0.53177 (98.9th percentile) and the huntr.dev reference is tagged Exploit, indicating public exploit detail exists. No ransomware usage is documented.

What to do

• Upgrade Gitea to 1.16.5 or later, which contains the patch commit e3d8e92bdc67562783de9a76b5b7842b68daeb48.
• If immediate upgrade is not possible, restrict or validate redirect targets on the login endpoint and block external redirect parameters.
• Educate users to verify the destination domain after logging in and to treat unexpected login links as suspicious.
• Monitor and filter outbound redirects from the Gitea login path to untrusted external domains at the web proxy or WAF.

Detection

• Review web/proxy logs for requests to the Gitea login endpoint containing external URL parameters or redirect targets.
• Alert on login responses that issue redirects to domains outside the organization's trusted set.
• Correlate huntr.dev or public exploit payload patterns against Gitea access logs for the login path.
• Audit Gitea version inventory to identify instances below 1.16.5.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.