CVE-2025-69413: 
NixOS vulnerability analysis and mitigation

CVE-2025-69413 is a user enumeration vulnerability in Gitea's /api/v1/user API endpoint that returns different error responses for failed authentication depending on whether a queried username exists. This allows unauthenticated remote attackers to determine valid usernames without any credentials. All Gitea versions before 1.25.2 are affected. The vulnerability was reported on November 19, 2025, patched on November 22, 2025, and published to the GitHub Advisory Database on January 1, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Gitea Release).

The root cause is classified as CWE-204 (Observable Response Discrepancy): Gitea's authentication logic returns distinct error messages depending on whether a username exists in the database. Specifically, when a non-existent username is submitted, the API returns "user does not exist", while a valid username with an incorrect password returns "user's password is invalid" (Gitea Issue). This behavioral difference in the /api/v1/user endpoint can be exploited by any unauthenticated network attacker with no special preconditions — only HTTP access to the Gitea instance is required. The fix, merged in pull request #36002, standardizes the error response to a unified message regardless of whether the username exists (Gitea PR).

Successful exploitation allows attackers to enumerate valid usernames on a Gitea instance without authentication, leaking confidential account information (low confidentiality impact). There is no direct integrity or availability impact. However, the enumerated usernames can be leveraged to conduct targeted brute-force or credential stuffing attacks against identified accounts, significantly increasing the likelihood of account compromise and potential unauthorized access to source code repositories (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any attacker with network access to a vulnerable Gitea instance. The EPSS score is approximately 0.019% (0.00067), indicating a low near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing or network-accessible Gitea instances running versions prior to 1.25.2 using tools like Shodan, Censys, or by directly browsing to the Gitea web interface.
2. Prepare username list: Compile a wordlist of candidate usernames (e.g., common names, organization-specific usernames, or usernames gathered from public Gitea profiles/repositories).
3. Send authentication requests: For each candidate username, send an HTTP GET or POST request to the /api/v1/user endpoint with Basic Authentication credentials (e.g., curl -u '<username>:wrongpassword' https://<gitea-host>/api/v1/user).
4. Analyze responses: Compare the error messages returned — a response of "user does not exist" indicates the username is invalid, while "user's password is invalid" confirms the username exists in the system (Gitea Issue).
5. Build valid username list: Record all confirmed valid usernames for use in subsequent targeted brute-force or credential stuffing attacks against the Gitea instance or related services.

• Network: High volume of HTTP requests to /api/v1/user from a single IP or small range of IPs, especially with varying usernames and incorrect credentials; requests using Basic Authentication with random or wordlist-based usernames.
• Logs: Gitea access logs showing repeated 401 Unauthorized responses to /api/v1/user with different usernames in rapid succession; patterns of alternating "user does not exist" and "user's password is invalid" error responses in application logs.
• Process/Behavior: Unusual spike in failed authentication attempts against the API endpoint without corresponding web UI login attempts, suggesting automated enumeration tooling.

Upgrade Gitea to version 1.25.2 or later, which standardizes the authentication error response to a unified message regardless of username validity, eliminating the enumeration vector (Gitea Release, Gitea PR). As interim mitigations for instances that cannot be immediately patched, implement network-level access controls to restrict access to the /api/v1/user endpoint to authorized IP ranges only, and apply rate limiting on authentication attempts to slow enumeration attacks (Github Advisory).