CVE-2026-104627

CVE-2026-104627 · Gitea OpenID account linking without session binding

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.

CVSS 5.4 · Media · EPSS 0,1%

Publicación

2026-10-18T18:51:06.543Z

Actualización

2026-10-19T20:20:15.460Z

Comprueba tu servidor →