CVE-2026-104627
CVE-2026-104627 · Gitea OpenID account linking without session binding
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.
CVSS 5.4 · Medium · EPSS 0.1%
- Published
- Updated
Affected products and versions
gitea
- Versions
- ≥ 0, ≤ 28.1.0: Affected (semver)
No fix published
Original sources
- https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx
- https://github.com/go-gitea/gitea/pull/39642
- https://github.com/go-gitea/gitea/pull/39744
- https://blog.gitea.com/release-of-28.2.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-104627