--- title: Forgejo Security Release 1.20.5-0 | daily.dev description: Forgejo v1.20.5-0 has been released with an important security fix addressing a vulnerability in the long-term authentication ('remember me') token mechanism.... canonical: https://daily.dev/posts/forgejo-security-release-1-20-5-0-3hgmamo0o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Forgejo Security Release 1.20.5-0 | daily.dev og:description: Forgejo v1.20.5-0 has been released with an important security fix addressing a vulnerability in the long-term authentication ('remember me') token mechanism.... og:url: https://daily.dev/posts/forgejo-security-release-1-20-5-0-3hgmamo0o og:image: https://api.daily.dev/og/posts/3hGMamO0o.png og:image:alt: Forgejo Security Release 1.20.5-0 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Forgejo Security Release 1.20.5-0 **[Forgejo News](https://daily.dev/sources/forgejo)** · 2 min read · 0 upvotes · 0 comments ## Summary Forgejo v1.20.5-0 has been released with an important security fix addressing a vulnerability in the long-term authentication ('remember me') token mechanism. Previously, a malicious actor with a copy of the Forgejo database could construct a valid long-term authentication token for any user without brute-force, enabling impersonation. The fix reworks the token construction to require additional information from the user's cookie, not just database values. All Forgejo installations are strongly urged to upgrade immediately. The Forgejo security team also notified the Gitea security team of the same issue on the same day, requesting a 90-day embargo before public disclosure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Forgejo v15.0 is available](https://daily.dev/posts/forgejo-v15-0-is-available-gfjkjnve8) · Lobsters · 0 upvotes · 0 comments - [Forgejo 15.0 released](https://daily.dev/posts/forgejo-15-0-released-uv9iwbzij) · LWN.net · 0 upvotes · 0 comments - [Forgejo 16.0.4 and 15.0.8 address critical security vulnerability](https://daily.dev/posts/forgejo-16-0-4-and-15-0-8-address-critical-security-vulnerability-vhpuap5nt) · LWN.net · 8 upvotes · 1 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#forgejo](https://daily.dev/tags/forgejo), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/forgejo-security-release-1-20-5-0-3hgmamo0o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Forgejo Security Release 1.20.5-0","url":"https://daily.dev/posts/forgejo-security-release-1-20-5-0-3hgmamo0o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/forgejo-security-release-1-20-5-0-3hgmamo0o"},"datePublished":"2026-07-26T07:49:03.689Z","dateModified":"2026-07-30T02:12:42.959Z","description":"Forgejo v1.20.5-0 has been released with an important security fix addressing a vulnerability in the long-term authentication ('remember me') token mechanism....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecd9058ec824271361a436684af5bb15?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecd9058ec824271361a436684af5bb15?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Forgejo News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Forgejo News","logo":"https://media.daily.dev/image/upload/s--Cq9uBvkb--/f_auto,q_auto/v1785052096/logos/forgejo?_a=BAMAMicg0","url":"https://daily.dev/sources/forgejo"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/forgejo-security-release-1-20-5-0-3hgmamo0o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,forgejo,security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Forgejo News","item":"https://daily.dev/sources/forgejo"},{"@type":"ListItem","position":3,"name":"Forgejo Security Release 1.20.5-0"}]} ```