CVE-2026-104627
CVE-2026-104627 · Gitea OpenID account linking without session binding
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.
CVSS 5.4 · Mittel · EPSS 0,1%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
gitea
- Softwareversionen
- ≥ 0, ≤ 28.1.0: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx
- https://github.com/go-gitea/gitea/pull/39642
- https://github.com/go-gitea/gitea/pull/39744
- https://blog.gitea.com/release-of-28.2.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-104627