Attackers Probe Critical Gitea Docker Auth Bypass via `X-WEBAUTH-USER`

Threat actors have begun probing a critical authentication bypass in official Gitea Docker images, tracked as CVE-2026-20896, shortly after public disclosure and patch release. The flaw stems from a default configuration that sets REVERSE_PROXY_TRUSTED_PROXIES = *, causing Gitea to trust the X-WEBAUTH-USER header from any source IP when reverse-proxy authentication is enabled. An attacker that can directly reach the Gitea HTTP service can impersonate any existing user without a password or session cookie, including administrators, and may also create accounts if auto-registration is enabled.

The issue affects Gitea Docker image deployments through 1.26.2 and was fixed in 1.26.3 and later by removing wildcard proxy trust and making reverse-proxy authentication opt-in. Researchers reported the first observed in-the-wild activity 13 days after disclosure, with reconnaissance tied to ProtonVPN-associated infrastructure, while public proof-of-concept details have increased the risk of broader exploitation. With roughly 6,200 internet-facing Gitea instances estimated to be exposed, organizations are being urged to upgrade immediately and review systems for unauthorized access.