CVE-2025-69413

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.